3 ms·

See this great post by Matt Jones (from FB antispam/security team) about Facebook's link shortener https://www.facebook.com/notes/facebook-security/link-shim-pr

See this great post by Matt Jones (from FB antispam/security team) about Facebook's link shortener https://www.facebook.com/notes/facebook-security/link-shim-protecting-the-people-who-use-facebook-from-malicious-urls/10150492832835766/ https://www.facebook.com/notes/facebook-security/link-shim-p...

Alex3917 8y ago
That's a decent point about email, but there is nothing they're doing on the website that couldn't be done without a link shortener. And even within the context of email it doesn't really make sense, because email clients can just do the same thing without rewriting the URL.
- peterhunt 8y ago
  How would you show an interstitial without rewriting the url?
  - megous 8y ago
    onclick handler and event.preventDefault
    - makomk 8y ago
      Replacing links with onclick handlers breaks "open in new tab".
      - megous 8y ago
        You can use window.open to simulate that. If you're fb, you're probably already whitelisted in the popup blocker. Though I agree it's not ideal.
  - Alex3917 8y ago
    Every time a link is clicked, send an event to the server with the URL so that it can be tracked. If the URL is already known to be malicious when the page is generated, either don't include the URL or use javascript to intercept the click event and display the interstitial. If links need to be checked for validity at the moment the user clicks them, then just wait for the 200 response and do the same thing, the performance would be identical either way.
    - peterhunt 8y ago
      And you think running that type of JS on the page is more secure than a simple redirect? What benefit do we get by adding all of this complexity? Also -- anyone who views a copy/pasted version of this content won't get this protection.
      - Alex3917 8y ago
        > And you think running that type of JS on the page is more secure than a simple redirect? It's not more secure, but it's not less secure and it doesn't break the web. It also shouldn't add an appreciable amount of complexity, given that most of the heavy lifting to sanitize, parse, and format UGC content already happens on the server. E.g. if you're already turning UGC snippets into an AST on the server so that you can cleanly syndicate them in different formats, having the AST generate some js around URLs isn't a big lift.
        peterhunt 8y ago
        Requiring js for your security features to work adds more attack surface area but yes, it can be mitigated. But so much extra complexity! I still don’t understand why you think url shorteners break the web.
        Alex3917 8y ago
        > I still don’t understand why you think url shorteners break the web. How do you know where the links resolve to once FB goes out of business? Given the fact that there are still lots of people whose entire job is translating 6,000-year-old grocery receipts from Sumeria, it's not at all unlikely that tweets being written today will be still be widely studied and considered important 10,000 years from now. But those short links are unlikely to resolve for even the next 20 years. Also, adding js should no longer add more attack surface now that we have things like subresource integrity in addition to CSPs.
inetknght 8y ago
I'd like to read this but I have facebook blackholed and refuse to change that. Do you have another link?
- ambicapter 8y ago
  https://web.archive.org/web/20180818114317/https://www.facebook.com/notes/facebook-security/link-shim-protecting-the-people-who-use-facebook-from-malicious-urls/10150492832835766/ https://web.archive.org/web/20180818114317/https://www.faceb...
- TeMPOraL 8y ago
  TL;DR: clicking on their shortener can trigger just-in-time malware scan; they can retroactively block links already sent to people; they can strip away the Referer; they can inject their own analytics.

Alex3917 8y ago

That's a decent point about email, but there is nothing they're doing on the website that couldn't be done without a link shortener. And even within the context of email it doesn't really make sense, because email clients can just do the same thing without rewriting the URL.

peterhunt 8y ago
How would you show an interstitial without rewriting the url?
- megous 8y ago
  onclick handler and event.preventDefault
  - makomk 8y ago
    Replacing links with onclick handlers breaks "open in new tab".
    - megous 8y ago
      You can use window.open to simulate that. If you're fb, you're probably already whitelisted in the popup blocker. Though I agree it's not ideal.
- Alex3917 8y ago
  Every time a link is clicked, send an event to the server with the URL so that it can be tracked. If the URL is already known to be malicious when the page is generated, either don't include the URL or use javascript to intercept the click event and display the interstitial. If links need to be checked for validity at the moment the user clicks them, then just wait for the 200 response and do the same thing, the performance would be identical either way.
  - peterhunt 8y ago
    And you think running that type of JS on the page is more secure than a simple redirect? What benefit do we get by adding all of this complexity? Also -- anyone who views a copy/pasted version of this content won't get this protection.
    - Alex3917 8y ago
      > And you think running that type of JS on the page is more secure than a simple redirect? It's not more secure, but it's not less secure and it doesn't break the web. It also shouldn't add an appreciable amount of complexity, given that most of the heavy lifting to sanitize, parse, and format UGC content already happens on the server. E.g. if you're already turning UGC snippets into an AST on the server so that you can cleanly syndicate them in different formats, having the AST generate some js around URLs isn't a big lift.
      - peterhunt 8y ago
        Requiring js for your security features to work adds more attack surface area but yes, it can be mitigated. But so much extra complexity! I still don’t understand why you think url shorteners break the web.
        Alex3917 8y ago
        > I still don’t understand why you think url shorteners break the web. How do you know where the links resolve to once FB goes out of business? Given the fact that there are still lots of people whose entire job is translating 6,000-year-old grocery receipts from Sumeria, it's not at all unlikely that tweets being written today will be still be widely studied and considered important 10,000 years from now. But those short links are unlikely to resolve for even the next 20 years. Also, adding js should no longer add more attack surface now that we have things like subresource integrity in addition to CSPs.

inetknght 8y ago

I'd like to read this but I have facebook blackholed and refuse to change that. Do you have another link?

ambicapter 8y ago
https://web.archive.org/web/20180818114317/https://www.facebook.com/notes/facebook-security/link-shim-protecting-the-people-who-use-facebook-from-malicious-urls/10150492832835766/ https://web.archive.org/web/20180818114317/https://www.faceb...
TeMPOraL 8y ago
TL;DR: clicking on their shortener can trigger just-in-time malware scan; they can retroactively block links already sent to people; they can strip away the Referer; they can inject their own analytics.