from Hacker News

URL shortening services: not secure at all

by backslash on 2/19/10, 6:05 PM with 10 comments

  • by pierrefar on 2/19/10, 7:13 PM

    I built (and sold) cli.gs, one of the 13 final complaint services. The system that evolved was effectively strict border controls along with frequent police checks:

    1. When a new URL shortening request is received, the requester is checked and the destination is also checked. If both pass, the new short URL is returned.

    2. When a short URL forwarding request was received (i.e. the bulk of the traffic), the destination is checked again at a configurable probability. If the destination is now deemed malicious, it is disabled on the spot and a message is shown. In times of spam attacks, the checking probability would be set to 100%.

    I blogged about this when it launched and started evolving:

    http://blog.cli.gs/news/new-anti-spam-and-anti-malware-featu...

    http://blog.cli.gs/news/more-anti-spam-and-anti-malware-prot...

  • by kmod on 2/19/10, 7:42 PM

    Interesting article, but I find the author's use of statistics to be quite bizarre...

    [quote] Approximately 68% of URL shortening services were Stage 1 Compliant.

    Approximately 56% of URL shortening services were exclusively Stage 2 Compliant. [/quote]

    It seems from his numbers that he just meant to not include the word "exclusively", even though it was italicized. Also, I'm not sure what prompted the venn diagram with three sections "A", "B", and "A and B". Most of the regions (such as "A"-and-"A and B"-not-"B") are empty, for good reason.

  • by jcromartie on 2/19/10, 7:24 PM

    Were they supposed to be safe? How can they be classified as "safe" or "unsafe?" It's like calling tar or zip utilities insecure because the archives produced might contain malware.

  • by ihumanable on 2/19/10, 9:17 PM

    Am I missing something or is the Venn Diagram horrible. There are "Stage 1 Compliant" and "Stage 2 Compliant" areas, the overlap of which would logically be "Stage 1 and Stage 2 Compliant" Instead there is a third area for "Stage 1 and Stage 2 Compliant" with the count in the label instead of the area.

    That whole chart is either ridiculous or I am a moron and can't parse it with my brain.

  • by ryandvm on 2/19/10, 7:14 PM

    Hmmm. I'm not sure URL shorteners should be "secure". The service I want from them is very well defined: take this long URL and make it very short.

    I am certainly not asking them to make a judgment on whether my request was well conceived.

    What's next? Blocking NSFW URLs? Pornographic URLs? Politically offensive articles?

  • by joshu on 2/19/10, 7:27 PM

    This seems dumb. The site's function, as defined, is to do a redirect. Not redirect plus a bunch of mysterious stuff.