Bitly finally starts taking privacy seriously

I've been ranting about Bitly for years! The ubiquitous link shortener had an interesting "feature" - add a + to the end of the URl and you could see all the statistics for the link. How many clicks, referers, location of users.

Here's a blog post I wrote about it way back in 2011.

I often used this feature to explore how popular companies and scammers were:

Terence Eden is on Mastodon

@edent

This is why we don't use bitly in our work.

*Anyone* can add a + to the end of the URl and see where your traffic has come from.
Are your users happy knowing you're leaking that data to the whole world? pic.x.com/lifOwP4HC8

---

Terence Eden is on Mastodon

@edent

Already nearly 200 people have fallen for this Amazon phishing attack.
Uses bitly to mask the true destination. Spread via SMS. pic.x.com/QaR80RU8B3

---

Terence Eden is on Mastodon

@edent

One for the click-through-rate nerds to ponder.
Mobile provider Three took 550,000 Direct Debit early.
It contacted all those affected - sending them a bitly link.
121,000 clicked on the link they were sent. pic.x.com/59Aaw7O4wU

---

Terence Eden is on Mastodon

@edent

2,500 people clicked this fake HMRC link - see the data at bitly.com/2d8GoK6+
Is there any way to report dangerous links to @Bitly? pic.x.com/MZNjQUkysr

---

Terence Eden is on Mastodon

@edent

It's easy to see how popular these scams are.
500 clicks bitly.com/ARG0S-Online+
400 clicks bitly.com/ARGOS_Online+

And BitLy still hasn't taken them down.

The AntiSocial Engineer

@antisocial_eng

The predictable seasonal pattern of social engineering. Round and round, year on year. Expect an increase in shopping and voucher scams. pic.x.com/lU3zGmdPXi

---

---

I even used it to track GCHQ's publishing schedule.

Well, the party is now over. As of last week, Bitly closed the hole. You can only see stats for your own URls:

Terence Eden is on Mastodon

@edent

Replying to @Bitly@Bitly Thanks. Mind if I ask when this change took place?

---

Bitly - The Connections Platform

@Bitly

Replying to @edent@edent Hi there, Terence. We made the change last week.

---

I'm glad that they've started to take privacy seriously - although I'm slightly sad that I can't eavesdrop on how well links are performing.

But, there's a lesson here. Don't use third-party intermediaries for your links. They sacrifice your privacy and your users' privacy, for very little in return.