The Short on Shorteners
Last updated: Jul 28, 2021
My partner and I received this text while watching YouTube. I ignored it. But with zero hesitation my partner tapped that link real good.
Screams in Cyber
… and it just redirected to Twitter. Turns out the NSW Police had sent this emergency broadcast out to residents in the Hunter Valley.
It does raise a few flags that I thought would be worth a… short… post on.
What is a Link Shortener
They turn a ‘Long Link’ into a ‘Short Link’. Users who click the Short Link are redirected to the longer one. Why would you do this?
- Brand Management
- To share cool stuff but within 140 char limits???
Lots of shorteners are available like https://bit.ly/376CtXi
If you’re anything like me, you’d be hesitant to click the link above. Thankfully, that service allows the use of a plus character to preview where you’re heading to, like so:
Gotcha. I hope I demonstrated something there. To bitly’s credit, they’ve done great work in improving their trust and safety, and the + preview page is a fantastic addition. Although, you have to know about the feature to use it right?
What stands out to you here?
Well besides the fact that I put red circles around things…
- A dodgy phone number
- A Call to Action w/ a dodgy link
- Urgency and Authority are being established
It looks like a scam text message and that’s THE problem! Shortened links using services like bit.ly are notorious for distributing malware, scamming people, or at least being a phishing vector.
I think that the NSW Police needs to genuinely reconsider whether bit.ly is appropriate to use as part of their emergency communication plan.
I see two scenarios playing out:
- People get trained to always click on links from bit.ly.
- People get trained to never click on links from bit.ly.
In scenario one, we have a scammer’s paradise. We now have an easily spoofed, repeatable, trusted avenue to phish aussies.
In scenario two, the emergency broadcast is useless. Security folk might rejoice that people have finally learned to not click on the thing. However, your userbase will lack context or be unaware that an emergency is occurring. This is a significantly worse problem.
Point being, both outcomes are bad.
So what to do?
AusPost delivers a few packages (2.8 billion in 2020 alone), so of course they’re going to have a strong business case for adopting their own link shortener. Now, users have confidence that it’s AusPost, they are able to choose delivery thats suitable for them, and AusPost can deliver more efficiently for its primary shareholder, the federal government.
So all I’m getting at is:
- Trust is important for Police to well.. police.
- Using your own Link Shortener helps establish trust
- We can find Jayden