Their email is particularly poor and contains a delightful example of how not to communicate issues like this. See if you can spot it:

In the same breath as warning their customers to look out for suspicious links in emails, they include two obfuscated Bit.ly links!

Anyone can create a Bit.ly link and give it any name.

For example - https://bit.ly/TicketMaster-DataSecurity-Incident.

I've written many times before about Bit.ly and why you should not use it. It stops users understanding where they're going, it trains users to ignore what a link says, it exposes your users to unwanted tracking, and it puts your links under the control of a 3rd party.

If you are ever confronted with a Bit.ly link, add a + to the end of it to see its destination - for example https://bit.ly/TU-sign-up+.

Companies need to do much better. Professional crisis communications writers need to understand the Internet and how to foster a culture of security.

Here's a blog post I wrote about it way back in 2011.

I often used this feature to explore how popular companies and scammers were:

Terence Eden is on Mastodon

@edent

This is why we don't use bitly in our work.

*Anyone* can add a + to the end of the URl and see where your traffic has come from.
Are your users happy knowing you're leaking that data to the whole world? pic.x.com/lifOwP4HC8

---

Terence Eden is on Mastodon

@edent

Already nearly 200 people have fallen for this Amazon phishing attack.
Uses bitly to mask the true destination. Spread via SMS. pic.x.com/QaR80RU8B3

---

Terence Eden is on Mastodon

@edent

One for the click-through-rate nerds to ponder.
Mobile provider Three took 550,000 Direct Debit early.
It contacted all those affected - sending them a bitly link.
121,000 clicked on the link they were sent. pic.x.com/59Aaw7O4wU

---

Terence Eden is on Mastodon

@edent

2,500 people clicked this fake HMRC link - see the data at bitly.com/2d8GoK6+
Is there any way to report dangerous links to @Bitly? pic.x.com/MZNjQUkysr

---

Terence Eden is on Mastodon

@edent

It's easy to see how popular these scams are.
500 clicks bitly.com/ARG0S-Online+
400 clicks bitly.com/ARGOS_Online+

And BitLy still hasn't taken them down.

The AntiSocial Engineer

@antisocial_eng

The predictable seasonal pattern of social engineering. Round and round, year on year. Expect an increase in shopping and voucher scams. pic.x.com/lU3zGmdPXi

---

---

I even used it to track GCHQ's publishing schedule.

Well, the party is now over. As of last week, Bitly closed the hole. You can only see stats for your own URls:

Terence Eden is on Mastodon

@edent

Replying to @Bitly@Bitly Thanks. Mind if I ask when this change took place?

---

Bitly - The Connections Platform

@Bitly

Replying to @edent@edent Hi there, Terence. We made the change last week.

---

I'm glad that they've started to take privacy seriously - although I'm slightly sad that I can't eavesdrop on how well links are performing.

But, there's a lesson here. Don't use third-party intermediaries for your links. They sacrifice your privacy and your users' privacy, for very little in return.

• bit.ly/󾰀󾰀

You can also use Emoji!

• bit.ly/☹
• bit.ly/♐

Well, OK, not all Emoji. If you try to use most of them, the Bitly system craps out and generates broken URls, like so:

But you can use most Unicode Miscellaneous symbols - some of which may have Emoji style representations on your system.

• bit.ly/♔♕♖♗♘♙♚♛♜♝♞♟

Please use this forbidden knowledge wisely.

I'm going to walk you, step-by-step, through a scam that targetted me today. Along the way we'll see how to avoid falling prey to these monsters.

It starts with a text

I was sent this SMS from a number that I didn't recognise.

Let's count the mistakes!

1. In the UK, we place the currency symbol before the number.
2. British English spells "authorise" with an S rather than a Z.
3. Amazon don't send out links using the bitly shortening service.

These phishers are hoping that you're too stupid to notice the mistakes. They are also betting that you're too busy to think for a minute about whether Amazon are likely to contact you via SMS rather than email or app notification.

Let's say you're tired enough to click through, what do you find?

Stealing Beauty

At first glance, this looks identical to the regular Amazon mobile sign in page.

But! Look closely. There are three obvious mistakes.

1. No https - you should know by now that you never enter your password unless the website is protected with those magic letters.
2. The web address is not amazon.co.uk! It is some other site. Again, you should never enter a password unless you are sure that the site is legitimate.
3. Finally - what is that � character doing at the bottom of the site? It should be a © symbol. Far too sloppy for Amazon.

Surely you wouldn't fall for this? Sadly, not everyone in the world is as bright as you.

Tell me more, tell me more

So, you unwisely entered your password. The scammers are already riffling through your Amazon account with the stolen password. They're buying themselves toys using your credit card. But they ain't done with you yet!

They want everything! Once they have your home address and phone number, they can bombard you with scams. Scroll down, and it gets worse.

Your bank details! Your mother's maiden name! Are these details enough for them to fool your bank? With all the information you're giving them, they'll be able to take over your entire life!

Fool me once

Because the scammers use bitly, we can take a look at how many people are clicking through this link.

By the time Bitly had flagged the link as malicious, over 250 people had clicked on it.

Would you have fallen for it? These scammers are betting that you're not paying attention. That you'll blindly trust any link you see.

Phone companies are powerless to stop this sort of spam - SIM cards can be purchased anonymously, and computers can pump out thousands of texts before their suspicious behaviour is noticed.

Bitly knows it is a vector for phishing attacks, but can't check every link before it goes live.

The only solid defence is you! It is up to you to keep your wits up, to examine every message you receive, and every link you click. You have to stay safe all the time - the scammers only need to get lucky once.

If you want to harden your defences, you need to take action now.

1. Activate Two-Factor Authentication for Amazon - even if someone steals your password, they'll also need your phone in order to log in.
2. Use LastPass to generate strong and unique passwords for every site you use. If you use the same password on multiple sites - it is only a matter of time before one is lost, and then all are lost.

Stay safe out there!

GCHQ

@GCHQ

Hello, world.
bit.ly/GCHQhello

---

As I never tire of saying, Bitly is a terrible at keeping your data private.

Simply add a + on to the URL and you can see some really interesting stats about the link and the user who created it?

Let's take a look at https://bitly.com/GCHQhello+

The link was created by a user called "barneyrooster". A little bit of digging shows that user has created several links for GCHQ - for example https://bitly.com/GCHQsig+ and http://bit.ly/GCHQterms+.

So, who is Barney Rooster? According to Bit.ly's API, the user's account was created today, 16 May 2016 08:08:13 GMT - the same day as their account started Tweeting. There's no active Twitter account with that name, and no one on LinkedIn or Facebook.

The only significant mention is a comic book character from the 1940s created by Frank Frazetta.

Here's a sample from the comic.

Curiouser and curiouser...

Remember, BitLy doesn't support https by default (a must for any security conscious organisation), it leaks your data, and leaks your visitors' data.

Let's just hope GCHQ remembered to turn on 2FA for the elusive Barney Rooster!

Update! The BarneyRooster user was deleted on the 17th of May. Be seeing you!

Even when someone releases "official" statistics, they're usually hard to verify independently, and even harder to analyse by region.

Benedict Evans - who I've had the pleasure of meeting at Mobile Monday - published some very interesting official stats on Facebook's mobile usage. The statistics show that roughly 44% of Facebook use is "not mobile".

How does that chime with reality?

I've talked before (incessantly!) about how leaky bit.ly is - they allow anyone to view detailed statistics about your marketing campaigns. Why people continue to use them, I've no idea. But, luckily for us, it allows us to get a fairly balanced view of Facebook's userbase.

UK supermarket Tesco have been running this "sponsored story" on Facebook. I assume that it is being pushed out to a large and broadly representative sample of UK Facebook users.

Using Bit.ly we can see the clickthrough statistics. You can click on the image for a live view of the stats.

Having run my own tests, it appears that clicks on a Bit.ly link from the Android or iOS app appear as though they come from m.facebook - as do clicks from the mobile web site. So we can't break down the stats any further. That said, it's always useful to get a secondary data point.

People are sharing your links on Facebook. Over half the people clicking on them will be doing so from a mobile phone. Does your site provide a great mobile experience? If not - it's time to up your game.

The campaign itself wasn't that great - a poor call-to-action and a decidedly mobile-unfriendly site - but I was interested in how many people had scanned them. Thanks to bit.ly's practice of exposing everyone's statistics, we can see exactly how well this campaign did.

Wow! Twenty-five thousand scans. It's not as good as Tesco's QR campaign (80k scans and counting) - but it's an interesting data point.

I don't know how many tickets these QR codes were printed on (I didn't see them on every ticket) so it's impossible to know the exact response rate. I do know that the cost of the codes was close to zero - black ink just isn't that expensive - and that part of the ticket isn't utilised for anything else.

QR codes aren't just for marketing hipsters from Shoreditch. They're increasingly popular with the British public, and I look forward to their continued use.

Take this recent example from Vodafone.

Aside from the obvious downsides (user doesn't know where the link will take them, if it's compatible, link looks like gobbledegook, etc) there is a rather more interesting issue.

Goo.gl - along with many other URL shortners - give everyone access to your statistics.

Visiting http://goo.gl/NdVGI+ will let you see everything.

I don't know how many messages were sent out, so it's hard to calculate a response rate.

From the map, I can see the two target areas were UK and (unsurprisingly) Greece. There are a few hits in other countries - that could just be people connecting via WiFi networks routed through that country.

There are also a few hits from iPhones - suggesting either the targeting wasn't accurate, or people are spoofing the iOS user agent.

Still, it's an interesting insight into Vodafone's marketing.

Facebook has, in its infinite wisdom, decided that I would be interested in adverts for cancer. Or, perhaps, AXA have decided that 30 something males are a prime market.

The creator of the advert was Equator's Fiona Dow who, judging from her bitly profile just loves posting about cancer.

As I have mentioned several times before, bitly links are a great way to (unintentionally) share your stats. If we look at the clickthrough stats for this advert, we can find some interesting nuggets.

Here's the biggie - referrers shows where people where when they clicked on the link:

In total, nearly half of all clicks came from the mobile site.

Perhaps this is why Facebook hasn't jumped into bed with any dedicated mobile advertiser? It would seem that users are equally willing to click on Facebook's "Sponsored Stories" on mobile as well as web.

(This assumes that AXA targetted both platforms equally).

The only fly in the ointment is, you guessed it, AXA don't have a mobile friendly site.

I've been banging on about mobile-friendly advertising for years - and still advertisers don't get it! Not everyone has an iPhone. Not everyone who has an iPhone is on WiFi or 3G. Not every one want to have to pinch and zoom. If the first impression you're giving your customers is that you don't care about their needs - don't expect them to stick around too long.

So based on this datum, Facebook users are willing to click on mobile ads - all it now requires is Facebook to show them at appropriate times and advertisers to create mobile-dedicated campaigns.

sigh A non-mobile site. With an Adobe Flash plugin in the top right which won't work on any iPhones. Why on Earth do marketing companies insist on pointing phones to non-mobile sites. It really bemuses me. Stations rarely have good signal (too many people leads to local network congestion) and, besides, large sites are a right pig to use on a small screen.

Stats

I've blogged several times about using Bit.ly links in QR codes. With a little bit of hacking (adding at + character to the end of the URL) we can see how many people have been scanning the code.

I don't know how many of these tickets have been printed. That might be a really good conversion rate - but I doubt it. I only noticed the QR code because someone had dropped their ticket and it landed face-down. Realistically, how many people look at the back of their tickets?

The best campaign in the world would fail if it's not put in front of an audience.

Here are the codes on the posters - click for bigger.

As all the codes use Bit.ly so we can see how well they've performed - click on each one for the latest statistics.

Not the most impressive of campaigns.

Three strong points to note before pointing out how (in)effective QR marketing is:

1. How many clicks would a traditional URL on a poster get?
2. The code with the call-to-action has the strongest response. Would the others have improved with a CTA?
3. How many of these posters are in the wild? I only spotted one set, but I suspect there are more.

QR Codes are Scanned by Mobile Phones

Why would you point a QR code at a non-mobile site? And, just as bad, why not point directly to an app-store when you want people to download an app? Ah, it's because your advert's promise of an Android app is a lie. Very disappointing.

If you need a bespoke QR consultation, please contact Terence Eden

As a mobile Internet consultant, companies often ask me which QR generator to use. There are many worth considering, but I always tell clients to avoid bit.ly.

The security of Libya Internet organisations are probably not an immediate concern (you did know that's what .ly stands for, right?). What is worrying is how bit.ly exposes your QR campaigns to your competitors.

How Does The Bit.ly QR Generator Work?

You can use Bit.ly to shorten URLs. Add a ".qr" at the end to get a QR code. Simple, easy, and insecure. http://bit.ly/uRmAhs.qr

Exposing Your Statistics

Here's a handy trick. Take any Bit.ly URL and add the + symbol to the end. https://bitly.com/nTTo9j+

Congratulations! You can see all the clicks, referrers, and other statistics.

There is, as far as I am aware, no way to prevent this. If you have used Bit.ly to generate a QR code - everyone can see how well your campaign has done.

Revealing Your Future Campaigns

Bit.ly's open access means anyone can see all the short URLs and QR codes you have ever created. Here is a list of all the QR codes created by Southeastern Trains. Here are all the FT's "How To Spend It" short URLs. It's amazing what you can find by rummaging about...

Imagine that you're preparing for a print-run for a future campaign. With several weeks lead time, you'd better get those Bit.ly links created before you send things off to the printers.

So, now any of your competitors can see what QR codes you are creating, what promotions you will be running, and how well they do in the future.

You can make your profile private by changing your settings - but it is public by default.

It's Not Under Your Control

Once you've created a Bit.ly link, it is unchangeable. If you've made a mistake with the link - tough. If you've printed thousands of posters with the Bit.ly code which points to the wrong place, you're out of luck. Bit.ly codes cannot be changed.

While Bit.ly has proved stable so far - what happens if the service breaks? You're reliant on a 3rd party - without an SLA - for your campaign.

Incomplete Statistics

Which phones are using the QR code? Bit.ly won't tell you - and there's no way to get the information. So, there's no way to tell which phone platforms you need to target. You do get some country by country breakdown, but that's it.

Conclusion

I would advise all companies to use their existing web infrastructure to create short URLs. If your web team can't create simple rewrites - fire them. Seriously, it's incredibly easy, it means you control the codes, to where they redirect, service levels, and get all the statistics you need.

Time to delete your Bit.ly links? Sorry, you can't do that either.

Feel the need for some bespoke QR consultancy? Contact me for details.

Tracey Emin

The Hayward Gallery are having a Tracey Emin retrospective. At the start of the exhibition is this rather odd QR code.

Why odd? Three main reasons.

1. It leads directly to a 14MB MP3 file.
2. The code is really quite small considering it's a low-lit gallery.
3. Rather that being printed directly onto the wall, it appears to be a separate sticker.

The MP3 is an audio guide to the exhibit. That's a great idea - let people listen on their own equipment rather than the gallery having to fork out for expensive audio playback devices.

The specific implementation has two major problems. Firstly - file size. While 14MB ought not to cost too much - unless you're a tourist roaming - the signal strength in the gallery isn't great, and there's no free WiFi. The audio isn't that well compressed - I was able to reduce it to 5MB with only a minor loss of quality. As users are likely to be listening on cheap mobile phone headphones, high-fidelity isn't always necessary.

Secondly, there's no warning that you're about to download a large file. The QR code goes straight to the MP3. I think a small mobile-friendly interstitial would have been useful here. Tell the user what's about the happen, how large the file is, etc.

Cambridge University

Cambridge University joins Kingston University in the "not-quite-getting-QR" camp.

The CTA is too far away from the code, the URL leads to a non-mobile optimised site, and they've taken the rather strange decision to use "bitly.com" rather than "bit.ly" as their URL's domain - adding 3 extra characters.

It's the use of Bit.ly by both Emin and Cambridge that I want to discuss.

Bit.ly Still Considered Dangerous?

I tell my clients to avoid using Bit.ly where possible. Especially for anything sensitive. I don't fully agree with Ben Metcalfe's analysis of the Lybian owned .ly tld - but bit.ly does have some rather worrying default security settings.

You can see a bit.ly URL's statistics by appending a "+" symbol to the end of the URL. So, here are the statistics from Tracey Emin's and Cambridge University's QR codes. Click the graphs for the full set of stats.

While this is great for nosey people like me who are interested in how well used QR codes are - do you really want your competitors knowing how well your campaign is doing?

So, how do we go from http://4sq.com/fgIWov to

1 Expand the URL

Get your Bit.ly API Key.

http://api.bitly.com/v3/expand
   ?shortUrl=http://4sq.com/fgIWov
   &login=YOUR_BIT_LY_USERNAME
   &apiKey=YOUR_BIT_LY_API_KEY
   &format=txt

You can, if you prefer, get the info back in JSON or XML. See the Bit.ly API Expand Documentation.

2 The Foursquare URL

Bit.ly gives us the URL which includes a checkin ID and a signature.

http://foursquare.com/edent/checkin/4d7e5b4f9df3f04d7400c394
   ?s=afH3jJg3L9HpLqVIwiqp-YpNL5k

3 The Foursquare API Call

From this, we construct an API call to Foursquare. It looks like this

https://api.foursquare.com/v2/checkins/4d7e5b4f9df3f04d7400c394
   ?signature=afH3jJg3L9HpLqVIwiqp-YpNL5k
   &oauth_token=YOUR_FOURSQUARE_OAUTH_TOKEN

NOTE the Foursquare URL says ?s= whereas the API call requires ?signature= That caused me more frustration than it should...

Getting your OAuth token is a little cumbersome - follow the steps at the Foursquare Developers site.

4 The JSON Response

I'll cut the cruft out of here, so you only see what you need to display images. The response gives us the link to the full sized image - as well as several different sizes should you wish to display thumbnails.

{
  "meta":{
     "code":200
  },
  "response":{
     "checkin":{
        },
   ...
   "photos":{
      "count":1,
      "items":[
         {
            "id":"4d7e5b4f9df3f04d7400c394",
            "createdAt":1300184596,
            "url":"http://playfoursquare.s3.amazonaws.com/pix/A.jpg",
            "sizes":{
               "count":4,
               "items":[
                  {
                     "url":"http://playfoursquare.s3.amazonaws.com/pix/B.jpg",
                     "width":720,"height":540
                  },
                  {
                     "url":"http://playfoursquare.s3.amazonaws.com/derived_pix/C.jpg",
                     "width":300,"height":300
                  },
                  {
                     "url":"http://playfoursquare.s3.amazonaws.com/derived_pix/D.jpg",
                     "width":100,"height":100
                  },
                  {
                     "url":"http://playfoursquare.s3.amazonaws.com/derived_pix/E.jpg",
                     "width":36,
                     "height":36
                  }
               ]
            },

5 Gotchas

Again, nothing in life is easy. Not all foursquare checkins have an image associated with them. In which case, we can do one of three things.

1. Display no image
2. Display the user's avatar - if it's public
3. Display an image of the venue - or one of the icons associated with it.

6 Embed.ly

Dabr uses the awesome Embedly service. Rather than having hundreds of different regular expressions and API calls to get embedded images, Embed.ly gives us a single end point to call. So, rather than rewrite huge chunks of Dabr's code, I've submitted this to the clever-clogs behind Embed.ly - that way, everyone can benefit.

Any questions, comments, or clarifications - please let me know in the comments box.

The Metro is a London-based UK newspaper national newspaper which is distributed in 33 cities across the UK. Around a year ago, I reviewed the Metro's mobile website. It wass a perfectly fine mobile site and I'm pleased to see that over the last 12 months it has undergone substantial improvements. You can visit it at http://metro.mobi/

This morning, I spotted this prominent QR code - placed on page 2 of the paper.

Photo by Benjamin Welby

So far, so good. There are a couple of flaws in the implementation which I'll come to. But first, the biggie.

Despite having a mobile site - guess what happens when you scan the QR code....?

Yes, that's right! Rather than pointing directly to metro.mobi, they're pointing to their main website metro.co.uk. Worse than that, the main website doesn't do any user-agent sniffing. Their front-end servers (or CDN) ought to detect mobile traffic and automatically redirect mobile devices to the mobile-friendly website.

Most phones will find the main site hard to navigate, flash adverts won't render, and the large data size will make downloading the page slow and potentially expensive.

Using Bit.ly

The main problem with this QR code is that it doesn't point to a mobile friendly site - but there are a few other gotchas.

Yes, you can use bit.ly to generate QR codes, but I wouldn't recommend it.

• Anyone - even your competitors - can see the statistics of your campaign. Visit http://bit.ly/gM06V2+ to see how many clicks the QR code has received. Where possible, you should use your own, private QR generating service.
• The short URLs are ugly! "gM06V2" is neither pretty nor memorable. Worse, a user typically has no idea what's behind that random string of characters and may be put off simply because they don't know where they will be sent. If you must use bit.ly - be sure to edit the code. For example, I've just created http://bit.ly/MetroMobile which looks nicer and points to the correct destination.
• What happens if the bit.ly services goes down? Your customers won't be able to access your services.
• What happens if Libya - the owners of .ly - decide to shut down bit.ly?
• Finally, do you need a URL shortner? http://metro.mobi is 17 characters, the URL used in Metro's QR code is http://bit.ly/gM06V2?r=qr - 25 characters!

I'm really pleased that the Metro is embracing QR codes. Much like the early days of URLs, we're bound to see a few mistakes - let's hope the kinks get straightened out before the public lose faith in these little magic squares.

Update

Just got this in from Martin Ashplant, the Head of Content at Metro.co.uk...

We are in the process of developing our offering so readers can choose whether they want to visit our website, which has richer content, or our mobile site. This choice will be available within a month.

We are comfortable with bit.ly for this particular campaign as it is our data and we are not concerned about it being public. However if we were to run such a campaign for a client we would of course make sure that the data remained private.

From the creators of QR Codes, Denso Wave

QR Code has error correction capability to restore data if the code is dirty or damaged. Four error correction levels are available for users to choose according to the operating environment. Raising this level improves error correction capability but also increases the amount of data QR Code size.

The more error correction, the easier the code is to read if a bit of it is missing.

Bit.ly's Code

Just from looking at this, we can see the vast amounts of redundant data. The resultant image is huge.  This makes it very difficult to scan for cameras with low resolution.

Google's Code

Using Google's chart API to QRify the same URL, gives us this.

My QR Generator

Using my mobile friendly QR generator gives this code.

Should You Use Large Levels Of Error Correction?

Generally speaking, no. Error correction beyond the default makes the code physically larger. Here are some good reasons why you may need more error correction than default.

• You're worried about physical damage to the code.
• Size isn't an issue - normally if it is going to be the sole item displayed.
• Machine readability needs to be marginally improved.
• You are sure that the camera reading the QR code will be of sufficient quality to decipher it.
• You prefer the aesthetics.  Some people find the repeating patterns soothing...

So, hurrah for LongURLPlease - a service which takes those horrid little links and turns them in to full sized URLs.

Here's the basic code in PHP to use the service.

function long_url($shortURL)
{
 //Use the LongURLPlease API
 $url = "http://www.longurlplease.com/api/v1.1?q=" . $shortURL;

 //Set up CURL
 $curl_handle=curl_init();
 curl_setopt($curl_handle,CURLOPT_RETURNTRANSFER,1);
 curl_setopt($curl_handle,CURLOPT_URL,$url);

 //Get the JSON response
 $url_json = curl_exec($curl_handle);

 //Close the connection
 curl_close($curl_handle);

 //Decode the JSON
 $url_array = json_decode($url_json,true);

 //Get the Long URL out of the array
 $url_long = $url_array["$shortURL"];

 if ($url_long == null) //The service couldn't find a long URL
 {
 return $shortURL;
 }

 return $url_long;
}

So, how should this be displayed to the user in Dabr?

There are three possibilities.

Display

<a href="short.url/foo">VeryVeryLong.Url/Bar</a>

This keeps the redirect, but it displays the full URL for the user.

Pros.

• Get to see what the content is.
• Allows the short URL service to record hits etc.

Cons.

• Won't highlight if you've already visited it.
• May cause problems if the VeryLong.Url is too long for the screen.

All Change

<a href="VeryVeryLong.Url/Bar">VeryVeryLong.Url/Bar</a> This completely replaces the short URL.

Pros.

• Hurrah! No more silly URLs.
• Will highlight if you've already visited it.
• You can seen what you're about to click on.

Cons.

• Breaks any statistics management the short URL service was performing (is this a con? Surely the receiving website should be recording such details?)
• May cause problems if the VeryLong.Url is too long for the screen.

Background

<a href="VeryVeryLong.Url/Bar">short.url/foo</a>

Pros.

• Will highlight if you've already visited it.
• You can seen what you're about to click on if you hover over the URL.
• Won't cause problems if the URL is too long for the screen.

Cons.

• Breaks any statistics management the short URL service was performing (is this a con? Surely the receiving website should be recording such details?)
• User can't immediately see what they're about to click on.

Conclusions

I prefer replacing the URL completely.  I see no value in the various short URL services.  The stats that they gather don't seem any better that those your webserver can provide.

However, long URLs can be messy - especially on small screened devices.

Long URLs on a BlackBerry

So, which do you prefer?