I've been into IT-sec for a few years now and I have recently gotten in to the whole reddit/r/netsec, twitter, security.stackexchange thing, to get more involved with the community. What surprises me alot is that people are posting shortened links everywhere.

How can It-sec people trust other it-sec people? Are people content with just using the lastest updates with NoScript and hope there is no one linking to a page with an advanced exploit kit or persistent xss vuln.

closed as unclear what you're asking by Bob Brown, Jens Erat, RoraΖ, Xander, Rory Alsop Feb 9 '15 at 15:26

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 3
    Are you asking how to minimise the risk from shortened links? If so, we have posts on that. If you are asking how we can minimise our risk from malware, we have many posts in that field. Can you clarify what you are asking. Have a look at other posts here to see if any help. – Rory Alsop Feb 9 '15 at 8:28

hope there is no one linking to a page with an advanced exploit kit or persistent xss vuln.

The risk with shortened links isn't really persistent XSS, but reflected XSS and phishing.

Let's assume stackexchange is open to persistent XSS. If I post a link to https://security.stackexchange.com/questions/414141/my-evil-question you would believe that it is secure, visit it, and my JavaScript code would be run. Using URL shorteners doesn't add anything to my attack (it might even make you more suspicious).

If on the other hand stackexchange is open to reflected XSS, the URL would look like https://security.stackexchange.com/questions/414141/my-evil-question?someParam=<script src=evil.attacker/script.js></script>, and in that case shortening the URL would be helpful to hide the injected script.

How can It-sec people trust other it-sec people?

Well, you shouldn't trust random people at reddit/r/netsec, twitter, security.stackexchange.

And yes, latest updates are a good idea (most browsers have at least some filtering to defend against reflected XSS, and some phishing filters), and NoScript is also good.

If you want to know what is behind a shortened link, check out this question about verifying shortened links.

Not the answer you're looking for? Browse other questions tagged or ask your own question.