51

Say there is a bank/financial service that wants to have hyperlinks on their secure website/domain (or even in emails they send out to customers). In some of these links there are some long/obscure URLs which link to one of their subdomains, but the long links are ugly and not very user friendly, so they want to have shorter, nicer links to put on the website or email.

  • What are the risks for a bank/financial service using an external URL shortener service, e.g. Bitly, for this?
  • Is it better for a bank/financial service to host this sort of short link to long link translation service on their own domain and infrastructure?
  • 61
    Using URL shorteners is common practice in scams to hide the domain which is obviously different to who the scammers are impersonating. If the bank often uses URL shorteners, their clients are more likely to click on shortened URLs from scammers. – TR_SLimey Apr 15 at 20:29
  • 34
    If my bank starts using URL shorteners hiding the domain name, I'll drop the bank. There are plenty of internal ways to fix this, going external is a major risk. – Mast Apr 16 at 8:22
  • 11
    If you can host this internally, then why use the long version, at all? - And, also, if an external agent can shorten your urls, why can't you? - Also, cool URIs don't change! – I'm with Monica Apr 16 at 9:35
  • 5
    It's worth noting that some banks even have their own TLDs, so this would facilitate branded short URLs. – cmbuckley Apr 16 at 11:40
  • 3
    I think this is fine if you host your own link-shortner, on your own domain, obviously using HTTPs, and using a cert clearly designating your bank's name. Don't train users to click foreign links. – Alexander - Reinstate Monica Apr 16 at 19:41
86

In some of these links there are some long/obscure URLs which link to one of their subdomains, but the long links are ugly and not very user friendly, so they want to have shorter, nicer links to put on the website or email.

Users generally don't have to type any URLs anymore since at least a few decades. In fact, if you have a look at this link, you'll see it is really long and yet you don't need to type any of it. Generally, URL shorteners are only useful if you have to transmit a URL via a medium that doesn't support hyperlinks, such as printing it on paper. And even there, QR codes are slowly getting implemented more and more to solve this exact problem.

What are the risks of using an external service to do this?

Webcomic showing the dangers of URL shorteners, Source: xkcd.com/1698/

Source: Randall Munroe, xkcd/1698, licensed under CC-BY-NC 2.5

By using URL shorteners, you promise that this URL will link to a trustworthy source. As long as your URL shortener of choice works and remains trustworthy, this works. However, once some time passes, that URL shortener may go out of business, and that domain will go up for sale once again. From that point on, you can't guarantee anymore if those old URLs will work (they probably won't), or what will happen if users visit them. Remember, that in the eyes of a user, this link came from you, so they will trust anything on that site to be from you - even though it might not be.

Has this happened in practice? Yes. In Windows XP, the Windows Media Player does not come with the required license to play DRM protected WMV files. Luckily for the user, Windows Media player has the URL to get the license hard-coded. Unluckily for the user, that URL does not longer point to Microsoft, but rather to a distributor for malware. Any user that still uses Windows XP and wishes to play a DRM-protected WMV file, will be redirected to malware by the built-in media player of their OS, only because of URL shorteners.

A better solution

If you distribute links only digitally, it does not matter how long URLs are. Users just click on the button and that is it. If you really need to distribute URLs in a format that is non-clickable, such as TV advertisements or print media, make your own URL shortener. If ACME Corp. offers a new product called the "Ultra-Gigatron 9001", then make the URL ac.me/ug9001. If that doesn't work, make it acme.com/ug9001. Subdomains are free, and so are path names. Just be aware that that URL needs to be up as long as you expect people to type it.

| improve this answer | |
  • 35
    Ironically, and contrary to the xkcd, for about 15 years the nuclear launch code was a well known 00000000. Not the point I know, just anecdotal. – user10216038 Apr 15 at 16:15
  • 9
    Note that SMS is a particular still-current case of limited length. – chrylis -cautiouslyoptimistic- Apr 16 at 1:37
  • 10
    Are you sure that the Windows XP DRM vulnerability is linked to a URL shortener? Can you provide a source for this information? I only found docs.microsoft.com/en-us/security-updates/securityadvisories/… and news.softpedia.com/news/… – Razvan Socol Apr 16 at 4:39
  • 6
    @user10216038 how do you know that? Can you give any reference? – onurcanbektas Apr 16 at 7:02
  • 12
    @user10216038 Nuclear launch codes are pretty much useless without access to Air Force One, the Nuclear Football, Mount Cheyenne or any other place where you can actually use them. It's not like you can click on a GET request and accidentally launch a nuclear missile. – Nzall Apr 16 at 10:45
25

Is it better for a bank/financial service to host this sort of short link to long link translation service on their own domain and infrastructure?

I think the question contains the answer. For me, the answer is a resounding yes. A URL shortener should use a domain name that is owned and controlled by the 'bank'. The stakes are too high here.

In addition to the very complete answer by MechMK1, we have to keep in mind that any legitimate service, before it even goes out of business, can also get hacked (and quite likely, will be hacked), especially when it provides a springboard to a juicy target.

Consumers have been taught to be wary of phishing, and if the bank dismisses that advice by using an URL that clients are not familiar with, they will sow mistrust and confusion. You could even expect that a number of clients will report the mail as a possible spoof. Customer support is supposed to be busy enough and should not have to deal with self-inflicted problems.

To sum up, if they want a shortener it's probably not going to be as short as t.co, but could be short enough for the purpose (eg avoid line break in E-mail). If they really insist they could buy a short domain name in .com or some country code extension, but that is still not a good idea. Because anybody can buy a domain name and fake whois data. The whois data in itself does not prove that the bank indeed owns and controls the domain name. The point is, you should have a coherent and somewhat predictable brand and naming strategy. That means, stick to the domain names that are already known and trusted by your client base.

Say there is a bank/financial service that wants to have hyperlinks on their secure website/domain (or even in emails they send out to customers). In some of these links there are some long/obscure URLs which link to one of their subdomains, but the long links are ugly and not very user friendly, so they want to have shorter, nicer links to put on the website or email.

We have different use cases here. For websites, using descriptive URLs is something normal, and is usually for SEO reasons. If some URLs are too long, rewrite them or alias them. For example, try to have no more than 3 keywords in the URL and choose the most relevant. A shortener is not the answer here. But you can have subdomains.

For advertising, short names are indeed essential if consumers are going to type them. But they have to be memorable too. Shorter is not always better: www.thebank.com/invest is still more memorable than t.co/Ba21dQ22. But that's why we have QR codes: to relieve people from typing URLs.

In fact, if the 'bank' is already using subdomains, they could assign one just for redirects. And then add a short parameter in the query string like a number.

For E-mails, you don't want long URLs because they can be cut off by the line break. If you send HTML E-mail, that is not a problem really, because a long hyperlink can be embedded in a short keyword. The problem is text E-mail or E-mail clients that do not render HTML, and there are not so many nowadays.

So what kind of problem are you trying to solve ? My overall impression is that the shortener is mostly a marketing gadget, and that the right course of action is to improve what already exists. If you have ugly URls, take the time to review them, prettify them, shorten them. A short URL can be convenient but is not 'pretty'.

| improve this answer | |
14

In addition to the other answers, I would like to stress that communications from a financial shall be easily verifiable for the user.

Say a customer receives a sms/email:

YOURBANK: Your purchase has been successful. More info https://bit.ly/2VBP5iK

Is this legitimate or not? Even if the to their IT team, that url itself provides no context, requiring them to dig into whatever urls it redirects to. And sometimes even them would not be able to ascertain if it is legitimate or not, e.g. when the bank marketing department decides to launch a campaign at yourbank-campaign.com rather than using their domain (and thus being detected as a phishing to yourbank.com).

Even if https://bit.ly/2VBP5iK now leads to https://yourbank.com/sign-in:

  • They wouldn't know who created that shortener. Even if it redirects to a legit page now, the author could later change it to a phishing page. Changing the target url between the legitimate and a phishing page would be a great way to confuse security teams.
  • You are training your users that bitly links from your bank are Ok. While any miscreant could create one of those pointing to a phishing to your entity.

And if you buy a new domain (e.g. https://yourba.nk/) to use as a shortener, do place in the website root a text like

This is the official shortener from yourbank.com. All entries here lead to official services by yourbank. See https://yourbank.com/faq#shortener

With the page https://yourbank.com/faq#shortener (at the main site), linked from it confirming the same information.

You will nevertheless end up with users thinking it leads to a phishing page, some blacklist adding a url from https://yourba.nk/, etc. but having a clear domain that can be whitelisted, and the proper information readily available will help a lot.

Note that while I would consider owning the shortener domain yourself a must, actually hosting the domain could be delegated to a third-party like bitly, instead of doing that in the bank infrastructure. That would share only some of the concerns other answers have mentioned (such as the shortener company getting compromised and redirecting [some of] your customers somewhere else). However, while it may be a useful service for another kind of company, for a bank the added cost of hosting a private shortener service would be negligible when compared with that of their normal page which those redirects will be targeting. So I wouldn't host it outside of my infrastructure either.

| improve this answer | |
  • Note: yourbank.com is a working domain name for the Pendleton Community Bank, so you may want to use a different url to avoid problems if they do end up implementing these links. – Nzall Apr 16 at 10:48
  • 13
    You are training your users that bitly links from your bank are Ok. — This, IMO is the biggest risk as it's the most easily exploitable. It's not whether Bitly goes out of business or expires, but if anyone can create https://bit.ly/new-lloyds-business-accounts and it looks just as legit as if it came from you, you're just asking to get your customers phished – anotherdave Apr 16 at 12:00
  • 1
    @anotherdave Agreed. It'd be slightly different if, for example, the US Government set up a URL shortener service at https://bank.gov which only officially registered and audited financial institutions could use. – Chronocidal Apr 16 at 16:53
  • 3
    Please don't do yourba.nk unless your main domain is excessively long. It's just pointless. You have enough space to write yourbank.com/go/1234 – user253751 Apr 17 at 11:45
  • 1
    Not only that, they could cloak the link, so when someone from the bank's IP range clicks the link, it goes to the bank page where it is supposed to. It only sends you to the scam link if your IP recently loaded a 1x1 pixel graphic that was in the email, is from a foreign country, whatever. – Harper - Reinstate Monica May 6 at 16:06
11

No matter, I hate the idea of sending sensible URL by mail!

When my financial partners do have something to communicate, I expect something like:

Some document are stored on your account at yourbank. Please use your regular login to connect your account's message box.

In case you forgot your login, use link written on your last bill or call us at number you may found at bottom of your last bill.

Using link in email lead to a lot of malicious thing like fake url using UTF-8 letters as domain, like Y0urbank.com or yⲟurbank.com (with ⲟ as ⲟ) and so on.

From there, strong url could simply figure on bank website or in my private space once logged, as simple href link.

`<a href="https:yourbank.com/complexUrl%20Holding%20Lot_of_characters">The link</a>
| improve this answer | |
  • 5
    Thanks, this is the only answer so far that addresses the XY problem in the question. I have accounts with 4 banks in a couple of countries and all of them have said something like "we will never send you a link in an email, always use a bookmark or search engine or type the URL yourself". They also all use internal messaging systems because email is simply not secure. Someone can even intercept the email en route and change the link. – craq Apr 17 at 18:51
5

No. Nobody should. They are not under your control, and can be redirected at another party's discretion. They can also be used to compromise the recipient's/your customer's privacy. There is no legitimate need for such services. If you really really want short URLs, run your own implementation (it's trivial to do) on your own domain. Otherwise just use normal ones.

| improve this answer | |
  • 1
    There are legitimate uses for such services, but they always involve linking to other sites than your own, and in many cases, not really having your own at all. They also always involve printed media, not e-mail or web. – Jan Hudec Apr 18 at 14:46
0

The URL didn't get ugly by itself

The business unit within the bank created the website. They are the ones who chose the web platform and URL. They are the ones who designed it to be a customer facing URL that is to go out in public communication.

So the marketing department needs to push back on that business unit and say "no no no, if you want this URL going out to customers, make it not 277 characters".

Then their webmaster would do whatever is required for that to happen, e.g. an internal redirector (in effect a TinyURL within the business unit).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.