<?xml version="1.0" encoding="UTF-8"?>
<?xml-stylesheet href="https://shkspr.mobi/blog/wp-content/themes/edent-wordpress-theme/rss-style.xsl" type="text/xsl"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	    xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	     xmlns:dc="http://purl.org/dc/elements/1.1/"
	   xmlns:atom="http://www.w3.org/2005/Atom"
	     xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	  xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>
<channel>
	<title>harmful &#8211; Terence Eden’s Blog</title>
	<atom:link href="https://shkspr.mobi/blog/tag/harmful/feed/" rel="self" type="application/rss+xml" />
	<link>https://shkspr.mobi/blog</link>
	<description>Regular nonsense about tech and its effects 🙃</description>
	<lastBuildDate>Sun, 22 Dec 2024 09:54:22 +0000</lastBuildDate>
	<language>en-GB</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>https://wordpress.org/?v=6.9.4</generator>

<image>
	<url>https://shkspr.mobi/blog/wp-content/uploads/2023/07/cropped-avatar-32x32.jpeg</url>
	<title>harmful &#8211; Terence Eden’s Blog</title>
	<link>https://shkspr.mobi/blog</link>
	<width>32</width>
	<height>32</height>
</image> 
	<item>
		<title><![CDATA[Bit.ly Considered Unsafe (for QR Codes)]]></title>
		<link>https://shkspr.mobi/blog/2011/12/bit-ly-considered-unsafe-for-qr-codes/</link>
					<comments>https://shkspr.mobi/blog/2011/12/bit-ly-considered-unsafe-for-qr-codes/#comments</comments>
				<dc:creator><![CDATA[@edent]]></dc:creator>
		<pubDate>Thu, 22 Dec 2011 14:00:44 +0000</pubDate>
				<category><![CDATA[qr]]></category>
		<category><![CDATA[bit.ly]]></category>
		<category><![CDATA[harmful]]></category>
		<category><![CDATA[mobile]]></category>
		<guid isPermaLink="false">http://shkspr.mobi/blog/?p=5022</guid>

					<description><![CDATA[(After Ben Metcalfe&#039;s post on the the vb.ly sage).  As a mobile Internet consultant, companies often ask me which QR generator to use.  There are many worth considering, but I always tell clients to avoid bit.ly.  The security of Libya Internet organisations are probably not an immediate concern (you did know that&#039;s what .ly stands for, right?). What is worrying is how bit.ly exposes your QR…]]></description>
										<content:encoded><![CDATA[<p>(<em>After <a href="http://benmetcalfe.com/blog/2010/10/the-ly-domain-space-to-be-considered-unsafe/">Ben Metcalfe's post on the the vb.ly sage</a></em>).</p>

<p>As a mobile Internet consultant, companies often ask me which QR generator to use.  There are many worth considering, but I always tell clients to avoid bit.ly.</p>

<p>The security of Libya Internet organisations are probably not an immediate concern (you <em>did know</em> that's what .ly stands for, right?). What is worrying is how bit.ly exposes your QR campaigns to your competitors.</p>

<h2 id="how-does-the-bit-ly-qr-generator-work"><a href="https://shkspr.mobi/blog/2011/12/bit-ly-considered-unsafe-for-qr-codes/#how-does-the-bit-ly-qr-generator-work">How Does The Bit.ly QR Generator Work?</a></h2>

<p>You can use Bit.ly to shorten URLs.  Add a ".qr" at the end to get a QR code.  Simple, easy, and insecure.
<a href="http://bit.ly/uRmAhs.qr">http://bit.ly/uRmAhs.qr</a>
<a href="http://bit.ly/uRmAhs.qrcode"><img src="https://shkspr.mobi/blog/wp-content/uploads/2011/12/uRmAhs.qrcode.png" alt="Bit.ly qrcode" title="Bit.ly qrcode" width="249" height="249" class="aligncenter size-full wp-image-5041"></a></p>

<h2 id="exposing-your-statistics"><a href="https://shkspr.mobi/blog/2011/12/bit-ly-considered-unsafe-for-qr-codes/#exposing-your-statistics">Exposing Your Statistics</a></h2>

<p>Here's a handy trick.  Take any Bit.ly URL and add the + symbol to the end.
<a href="https://web.archive.org/web/20150418091643/https://bitly.com/nTTo9j+">https://bitly.com/nTTo9j+</a>
<a href="https://shkspr.mobi/blog/wp-content/uploads/2011/12/Bitly-stats-exposed.png"><img src="https://shkspr.mobi/blog/wp-content/uploads/2011/12/Bitly-stats-exposed-300x169.png" alt="Bitly stats exposed" title="Bitly stats exposed" width="300" height="169" class="aligncenter size-medium wp-image-5038"></a></p>

<p>Congratulations! You can see all the clicks, referrers, and other statistics.</p>

<p>There is, as far as I am aware, <strong>no way to prevent this</strong>. If you have used Bit.ly to generate a QR code - everyone can see how well your campaign has done.</p>

<h2 id="revealing-your-future-campaigns"><a href="https://shkspr.mobi/blog/2011/12/bit-ly-considered-unsafe-for-qr-codes/#revealing-your-future-campaigns">Revealing Your Future Campaigns</a></h2>

<p>Bit.ly's open access means anyone can see all the short URLs and QR codes you have ever created.  Here is <a href="https://web.archive.org/web/20150418102645/https://bitly.com/u/southeastern">a list of all the QR codes created by Southeastern Trains</a>.  Here are all the FT's "<a href="https://web.archive.org/web/20150418113720/https://bitly.com/u/sibtwitter">How To Spend It</a>" short URLs. It's amazing what you can find by rummaging about...</p>

<p>Imagine that you're preparing for a print-run for a future campaign.  With several weeks lead time, you'd better get those Bit.ly links created before you send things off to the printers.</p>

<p>So, now any of your competitors can see what QR codes you are creating, what promotions you will be running, <em>and</em> how well they do in the future.</p>

<p>You can make your profile private by changing your settings - but it is public by default.</p>

<h2 id="its-not-under-your-control"><a href="https://shkspr.mobi/blog/2011/12/bit-ly-considered-unsafe-for-qr-codes/#its-not-under-your-control">It's Not Under Your Control</a></h2>

<p>Once you've created a Bit.ly link, it is unchangeable.  If you've made a mistake with the link - tough. If you've printed thousands of posters with the Bit.ly code which points to the wrong place, you're out of luck. <a href="https://web.archive.org/web/20120327220646/https://bitly.com/pages/help#i_1_1">Bit.ly codes cannot be changed</a>.</p>

<p>While Bit.ly has proved stable so far - what happens if the service breaks?  You're reliant on a 3rd party - without an SLA - for your campaign.</p>

<h3 id="incomplete-statistics"><a href="https://shkspr.mobi/blog/2011/12/bit-ly-considered-unsafe-for-qr-codes/#incomplete-statistics">Incomplete Statistics</a></h3>

<p>Which phones are using the QR code? Bit.ly won't tell you - and there's no way to get the information.  So, there's no way to tell which phone platforms you need to target.
You do get some country by country breakdown, but that's it.</p>

<h2 id="conclusion"><a href="https://shkspr.mobi/blog/2011/12/bit-ly-considered-unsafe-for-qr-codes/#conclusion">Conclusion</a></h2>

<p>I would advise all companies to use their existing web infrastructure to create short URLs.  If your web team can't create simple rewrites - fire them.  Seriously, it's incredibly easy, it means you control the codes, to where they redirect, service levels, and get all the statistics you need.</p>

<p>Time to delete your Bit.ly links? Sorry, <a href="https://web.archive.org/web/20120327220646/https://bitly.com/pages/help#i_1_2">you can't do that either</a>.</p>

<p>Feel the need for some bespoke QR consultancy? <a href="http://edent.tel/">Contact me for details</a>.</p>
<img src="https://shkspr.mobi/blog/wp-content/themes/edent-wordpress-theme/info/okgo.php?ID=5022&HTTP_REFERER=RSS" alt="" width="1" height="1" loading="eager">]]></content:encoded>
					
					<wfw:commentRss>https://shkspr.mobi/blog/2011/12/bit-ly-considered-unsafe-for-qr-codes/feed/</wfw:commentRss>
			<slash:comments>4</slash:comments>
		
		
			</item>
	</channel>
</rss>
