Hopefully this will cause companies to think twice about implementing someone else's link shortening service within their software solution. I've done several

Hopefully this will cause companies to think twice about implementing someone else's link shortening service within their software solution. I've done several reviews of software solutions which have used bit.ly and other shortening services for things like providing a link to corporate identity portals. It's quite common for a company to want to use their own identity portal for employee authentication with a particular piece of software and a few companies implement this via giving users shortened links which resolve to the identity portal location. They will hardcode the request to bit.ly & then give the users the token to enter when the software starts. It will then send the full bit.ly request and get a destination location back for the portal. In every case I've seen this, I've written it as a high risk finding since neither the software vendor nor the company using the solution has ever done an audit of the security controls at bit.ly or the other link shortening services. If a link shortening company like bit.ly is compromised & a bad guy is able to modify link destinations then it's pretty much over in terms of security for a software solution implementing this model. There also tends to be some issues in terms of implementing public key or certificate pinning when using a third-party but I'll save that for another day.