URL Shorteners: Handy but Risky
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
URL shorteners: handy but risky
Twitter, with its 140-character update window and lack of support for images, videos and files, has spawned an "ecosystem" of supporting sites and services. Highly popular among these are services like bit.ly and cli.gs that make lengthy URLs shorter.
URL shorteners are very handy for getting character counts down to fit into the small space of a Twitter update, IM, etc. They're also nice for creating URLs that don't "break" when emailed. (Large URLs often become corrupted when split from one line to another in email.)
Let's say you're heading off to school and you want to ask mom and dad for an HP Pavilion dv4t Special Edition netbook. Just copy the URL from HPShopping.com into an email and send it to the folks:
http://www.shopping.hp.com/webapp/shopping/computer_series.do?storeName=computer_store&category=notebooks&series_name=dv4tse_series&a1=Category&v1=Ultra-Portable
Problem is, it's 165 characters. It will be unreadable in many email clients. And it's too long to tweet or DM on Twitter. The solution is to shorten it. There are dozens of URL shortening services available. Some merely make a shorter URL. Others, like bit.ly or cli.gs, add metrics (information on how often the URL has been clicked and other data), tools for managing URLs, and "vanity" URLs which can end in short English-language words instead of seemingly random strings like gh56he6.
As intriguing as it might seem, makemyurlshorter.com probably does not make your URL shorter. The shortest URLs I know of are generated by four-letter domain URL shorteners. I use is.gd, which creates 17-character URLs, if brevity is the primary goal. Otherwise, I use cli.gs. Bit.ly is the currently the most popular.
A not-so-short list of shorteners
If you're shopping for a URL shortener, there is a list of (ironically) 196 of them (so far) on the Go2.me blog
Security risks of URL shorteners
There are many risks associated with URL shorteners that affect both business and personal users. Principal among these is that shortened URLs mask the source of the original link, so that they might point to content that is pornographic, violent, racist or other otherwise inappropriate. This is worrisome to both personal users who don't want to view this material and especially don't want their children to be exposed to it, and to business users who don't want employees viewing it and don't want their company associated with it.
This presents a challenge for businesses that choose to block inappropriate sites and content. Since shortened URLs mask the originating site, and most firewall software blocks by domain or IP address, corporate IT people are forced to either block all shortened URLs, or adopt solutions that decode URLs on the fly and test against a list of approved and banned domains. This is one more burden corporate IT departments don't need, and a problem services like Twitter need to respond to if they are to be taken seriously as business communications tools.
Jennifer Leggio, in a post on her ZDNet blog, quotes online security expert Dragos Ruiu:
"The negative part of this 'shortification' comes from the obscuring the visibility to the text of the URL before it gets sent to your browser -- it's a possible injection vector for direct browser URL exploits, of which there have been lots of varieties, and a way to send them to people without having the URL be inspected or visible. Or possibly just a way to send people to sketchy domains with worse hosted documents."
If the service you are using folds, or is unavailable due to IT outages, these shortened URLs will all be rendered useless on your blog, web site, Twitter/FriendFeed stream, etc. For this reason, most businesses are better off hosting their own shortened URLs in the form of "vanity" URLs, like http://www.hp.com/netbook, which are more secure, less prone to interruption of service, and more memorable to users. (It's often not possible to keep URLs this simple on shopping sites that use URLs to track complex transactional data, but other, more consumer- and communications-friendly approaches are needed.)
Yet another drawback of shortened URLs is the impact on Search Engine Optimization (SEO). Because shortened URLs mask the source site, analytics for that site may not factor traffic from these abbreviated URLs.
URL lengtheners
As I mentioned earlier, one solution to the problem of shortened URLs is to expand them before sending them to a browser. Services that do this, like Untiny.me have started to show up. There is an Untiny toolbar app, and Untiny's API lets developers include this capability in other programs and environments, so it's only a matter of time before this is built in to popular sites and services.
Responsibility of service providers
Service providers need to take an active role in preventing the use of shortened URLs to mask inappropriate content. Many sites take the attitude that they are merely tools, or a means by which people can communicate anything they'd like to, and that breaches are policed by "the community." More often than not this approach leads to a form of anarchy, unhappy users and migration to other sites. To maintain a safe environment for users, and one in which businesses can feel comfortable, site owners need to do more. Every URL shortener should have a Terms of Service (TOS) prohibiting these questionable uses, and defining penalties (deletion of URLs, banishment) for offenders.
This morning I was complaining on Twitter about the proliferation of spam followers and bogus URLs. I clicked on one TinyURL, and was pleased to see the company (one of the earliest URL shorteners) has a TOS and is enforcing it:
The company states in its brief Terms of Use "TinyURL was created as a free service to make posting long URLs easier, and may only be used for actual URLs. Using it for spamming or illegal purposes is forbidden and any such use will result in the TinyURL being disabled and you may be reported to all ISPs involved and to the proper governmental agencies."
So, if your business or personal use requires shortened URLs, factor the benefits and the risks of shortened URLs. And if someone emails you or tweets you a shortened link, as in all things connected with information, consider the source before clicking.