Human memory is a finite system. George A. Miller’s 1956 work “The Magical Number Seven, Plus or Minus Two: Some Limits on our Capacity for Processing Information“ argued that the average individual can hold just seven digits in his or her immediate memory at any given time.

It’s no surprise, then, that short URLs have become a common way to solve the problem of massive Web addresses, simplifying the process of recall and access. According to Threatpost, however, new research suggested that the ease of shorter URLs may be long on problems when it comes to cloud storage and collaboration.

The Big Deal With Short URLs

In their new paper “Gone in Six Characters: Short URLs Considered Harmful for Cloud Services,” Vitaly Shmatikov of Cornell Tech and independent researcher Martin Georgiev take aim at cloud services that integrate URL shorteners such as Microsoft OneDrive and Google Maps.

As noted in their work, there’s no absolute limit to the number of characters present in a URL, meaning they can quickly grow beyond the scope of human memory; even writing them down easily introduces errors if a single digit is missed or replaced. Short URLs emerged as a way to cut down on Web clutter and enhance the user experience. Initially, concerns were raised over destination: What if supposedly safe URLs actually led to malicious websites?

Now, two new threats have emerged: storage and collaboration. Shmatikov and Georgiev found that short URLs using just five- or seven-character tokens made it possible for attackers to scan the entire set of shortened addresses governed by the same ruleset.

In OneDrive’s case, that ruleset was predictable, allowing the researchers to resolve 42 percent of shortened URLs and access almost 20,000 OneDrive folders, many with write permissions. Thus, anything supposedly obfuscated by a smaller URL and kept private is nevertheless public domain for anyone willing to do a little brute-force work.

The team also found that shortened Google Maps URLs often resolved to very specific driving directions, meaning physical addresses or even identities could be compromised.

More worrisome than storage is collaboration since, in corporate environments, cloud-shared files are often pushed to user devices on a regular basis to ensure everyone is on the same page. If cybercriminals managed to slip malware into a write-enabled storage drive, they could effectively compromise an entire network.

Large-Scale Adoption

URL shortening has quickly become the norm rather than the exception. TechCrunch noted that Facebook has created its own shortener, which is now being used in conjunction with Messenger to streamline social communication — and it isn’t something businesses can opt out of when using the service.

For its part, Google responded by bumping up its Maps token length after being contacted by Shmatikov and Georgiev, in addition to making it more difficult to scan URLs. Microsoft, meanwhile, denied that the findings constituted a security risk and cut off communication. However, last month the company removed automatic URL shortening from OneDrive.

Bottom line? Shorter is better for people — but some of these people are cybercriminals. For the moment, short URLs are a toss-up between convenience and risk; going too small in the cloud can lead to big problems on the ground.