YNOT – Bit.ly, one of the most popular link-shortening services on the Web (two others among dozens are Snipr.com and TinyURL.com), has mounted a first-of-its-kind effort to help users avoid spam, phishing schemes and malware by hooking up with three Web-security organizations that will scan bit.ly links in real-time. Bit.ly’s developers hope the move will provide users of social-networking sites like Twitter and Facebook — where shortened links are as common as flakes in a snowstorm — with peace of mind.Shortened links are more than a convenience for Twitter fans. In their original form, all by themselves some URLs can occupy more than the 140 characters allowed in a tweet. In email and on Web pages, shortened URLs have an aesthetic effect that is difficult to dismiss.
However, it didn’t take long for scammers and cybercriminals to discover one nasty side-effect of link shortening: The original URL is obscured until the clicker lands on the target page. By then it’s too late to avoid any underlying mischief. Hence, shortened URLs are anathema for many cybercitizens, who won’t go anywhere near them with a mouse. That defeats the purpose of linking and deprives users of experiences that may be interesting, informative and downright humorous. Twitter, in particular, is less useful when links aren’t trusted.
In response, bit.ly plans by the end of the year to implement solutions from Verisign, Sophos and Websense to scrub the more than 40 million links users create daily.
Verisign’s iDefense IP reputation system will be the first to go live, toddml posted to the bit.ly blog. iDefense employs a blacklist of known malicious URLs, domains and IP addresses. An implementation of Websense’s Theatseeker Cloud service will follow, using heuristic tools to analyze target content. Finally, an evidently unnamed service from Sophos will employ what toddml called “behavioral analysis technology” to detect spam and malware proactively.
“The team here at bit.ly remains committed to transparency,” toddml wrote. “If you’re concerned about any given bit.ly link, you can add a ‘+’ sign to the end of the URL to see more information about it, or download our preview plug-in” for Firefox.
Once the new protection services are in place, suspicious bit.ly links will redirect users to a warning page requiring them to click through to the target once they have been apprised of the possible threat. No links will be blocked automatically, according to bit.ly General Manager Andrew Cohen.
“We wouldn’t want to block you from shortening a page on the Web, because then the service could seem to be broken,” Cohen told The Washington Post’s Brian Krebs. “If you input a URL and nothing happens, you’ll just think bit.ly is broken and wouldn’t necessarily know we’re saving you from going to the bad site.”
