Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I accidentally made my link shortener into a malware honeypot

app.y.gy

Post reply on HN
Print view View original

41–50 of 118 posts

Re: I accidentally made my link shortener into a malware honeypot

#41

Post by AceJohnny2 »

Tangentially, it's kinda funny how people really don't realize how much websites/companies/social system implement user-unfriendly behavior because of scammers or other bad actors. (Admittedly, it's something that I also did not understand when I was younger and more naive. Hell, I had to explain this to my 70y-old parent just a few weeks ago!)

The price of success is you then need to deal with moderation in some form. (and on that note: "it is easier to automate bad behavior than it is to police it")

Right now, "enshittification" is (rightly) on many people's minds, but before that the reason any company makes a process difficult is because some assholes ruined it for the rest of us.

Re: I accidentally made my link shortener into a malware honeypot

#42

Post by tpurves »

Semi related. When I worked at Visa, I developed some ideas around making QR codes slightly more resilient to malicious hijacking when used in the context of a payments or commerce usecase. The idea was for the scanning app to look not just for a QR but also look for adjacent payment acceptance marks (e.g. branded Visa, MC, PayPal, or a merchant's brandmark etc.) and then dynamically only resolve URLs to registered domains associate with those marks. The idea was that QR codes not human readable, and URLs are a lot to ask the average person to reliable parse. So instead, have the scanner also see and understand the same contextual cues that the human can see and understand. And for the human, give them the confidence to scan QRs that will take them to a domain they would expect, and not to a Rick Astley video or worse.

Re: I accidentally made my link shortener into a malware honeypot

#43

Post by not2b »

No disrespect to the folks at y_gy who are clearly doing their best. But link shorteners, even when used by good faith actors, are problematic because they hide the destination of the link, and of course that's an invitation for bad faith actors to exploit, so the battle will be endless. Shorteners got popular on Twitter back in the days when all the characters in the URL counted against a very short limit. But there's less need to use them these days, and I am very reluctant to click on shortened links and don't think that this is unusual.

Re: I accidentally made my link shortener into a malware honeypot

#44

Post by xyst »

JoshTriplett wrote: post #18

What's the benefit of a link shortener, these days? It made sense back before Twitter had one of their own. And I know that some people use it to get link analytics. I've also occasionally seen it used for printed materials, to get pretty URLs that are easy to hand-type. People also use it for malicious purposes, such as hiding malware, or disguising referral links, or otherwise trying to obfuscate where a link is go…

More for vanity and possibly increases engagement. Like you said, if I want a group of people to visit a link. Would you type in

“q.ly/abc” or “website.com/20240229/my-blog-title-here/1”

But as some have mentioned, QR codes have easily replaced URL shorteners for this purpose anyways.

Also I guess for the very small number of people without a device that can’t read QR codes, a shortened url would help them engage

Re: I accidentally made my link shortener into a malware honeypot

#45

Post by AceJohnny2 »

AceJohnny2 wrote: post #41

Tangentially, it's kinda funny how people really don't realize how much websites/companies/social system implement user-unfriendly behavior because of scammers or other bad actors. (Admittedly, it's something that I also did not understand when I was younger and more naive. Hell, I had to explain this to my 70y-old parent just a few weeks ago!) The price of success is you then need to deal with moderation in some for…

And, at the risk of getting too philosophical, this is also the story of life.

Parasitism is the reason things are as they are. But we got Sex out of it [1], so that's nice? Maybe?

[1] https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5204169/

Re: I accidentally made my link shortener into a malware honeypot

#46

Post by hoistbypetard »

JoshTriplett wrote: post #18

What's the benefit of a link shortener, these days? It made sense back before Twitter had one of their own. And I know that some people use it to get link analytics. I've also occasionally seen it used for printed materials, to get pretty URLs that are easy to hand-type. People also use it for malicious purposes, such as hiding malware, or disguising referral links, or otherwise trying to obfuscate where a link is go…

I have written my own URL shortener. I do it partly to get URLs that are nice to type in printed materials.

I also use it to hedge my risks from using SaaS. For my org, we host some things that we offer to the public on different services. Sometimes a vendor doesn't work out. We use our shortened URLs in public communications, and I can redirect them to our new service if we need to switch. It was a way to address my discomfort with URLs that break too easily when you host on 3rd party services.

Re: I accidentally made my link shortener into a malware honeypot

#47

Post by hoistbypetard »

joshstrange wrote: post #31
TehShrike wrote: post #30

Earlier quoted context omitted.

Sending SMS messages to users/customers

This is a valid use case, my company does this, but I would never outsource it when a link expander isn't difficult to build exactly to the spec you want/need.

Yep. I built my own for a similar reason. It went from "we need a URL shortener" on a Wednesday to "we have a robust URL shortener in production" the next Monday.

Re: I accidentally made my link shortener into a malware honeypot

#48

Post by yogorenapan »

xyst wrote: post #44
JoshTriplett wrote: post #18

What's the benefit of a link shortener, these days? It made sense back before Twitter had one of their own. And I know that some people use it to get link analytics. I've also occasionally seen it used for printed materials, to get pretty URLs that are easy to hand-type. People also use it for malicious purposes, such as hiding malware, or disguising referral links, or otherwise trying to obfuscate where a link is go…

More for vanity and possibly increases engagement. Like you said, if I want a group of people to visit a link. Would you type in “q.ly/abc” or “website.com/20240229/my-blog-title-here/1” But as some have mentioned, QR codes have easily replaced URL shorteners for this purpose anyways. Also I guess for the very small number of people without a device that can’t read QR codes, a shortened url would help them engage

As a user, I’m much more likely to click on the second link. Too many link shorteners come with ads and other annoyances that I’d rather not touch them. redirect-checker.org if I must

Re: I accidentally made my link shortener into a malware honeypot

#49

Post by mid-kid »

What worries me the most about things like these is that it makes it seem like it's impossible to make "free for all" products like these anymore if you're not an established player already. You will get blacklisted and you will receive emails from your host telling you to shut it down...

Established players like bitly and tinyurl didn't have all the resources to deal with the problem when they started out either, and they arguably still don't, yet they get favored by the antivirus vendors and "safe"search blacklists, since they're well-known services. It doesn't seem fair.

Is this really the way it should be? I wonder if they could've explained the situation to the antivirus vendors: The site itself doesn't host malware and doesn't allow the discovery of said malware through its service. It requires a user to receive an exact URL, just like they could've received any other link, and the blocklists should operate on what's hidden behind it instead of the redirect in front. Maybe y.gy could've been hooked into the safesearch API to automatically nuke any URLs blacklisted already by them, or another antivirus vendor.

Re: I accidentally made my link shortener into a malware honeypot

#50

Post by Scoundreller »

JoshTriplett wrote: post #18

What's the benefit of a link shortener, these days? It made sense back before Twitter had one of their own. And I know that some people use it to get link analytics. I've also occasionally seen it used for printed materials, to get pretty URLs that are easy to hand-type. People also use it for malicious purposes, such as hiding malware, or disguising referral links, or otherwise trying to obfuscate where a link is go…

Sometimes reddit (and likely others) will try to parse a URL's valid characters as formatting and deadlink them (e.g. some wikipedia links with special characters)
Post reply on HN