Twitter Direct Messages are now a primary carrier of phishing attacks and spam. With Twitter’s 140-character limit, which generally forces shortened URLs, it is impossible to tell at a glance if a link is safe. Unless you use a URL lengthener, an application that restores the original link based on a shortened link from bit.ly, is.gd, tinyurl, etc. If you know the source of a link, you can make an informed decision about whether to click it, or delete the DM and run away.

Long URL Please, which, according to its web site, supports bit.ly, cli.gs, digg.com, is.gd, j.mp, kl.am, su.pr, tinyurl.com, and other services, is available as a Firefox plug-in or as an API for developers who want to include the functionality in an application. I installed the Long URL Please plug-in and now when I open a DM, original, not shortened, links are visible. For example, I received a DM promoting the Web 2.0 Expo, and with Long URL Please could see that the link had the right domain, web2expo.com. The advantage of a plug-in implementation like this is you don’t have to copy-and-paste the link for “processing” at a separate location. All shortened URLs appear automatically in their original unshortened format.

Twitter, with its 140-character limit, created an entire industry dedicated to URL shortening. But shortened URLs pose many problems. They hide their source and can mask spam, malicious sites, porn, phishing attacks and other nuisances. Many companies, in fact, block shortened URLs at the firewall. (I wrote earlier this year on URL shorteners and the value and risk they bring.)

This post does not attempt to answer the larger problem of Twitter DM Spam, which has, for some, made DMs useless. One approach might be Twitter spam button in every DM that adds the sender to a community spam list like the one Akismet creates. It works on this blog.

Tags: URL shorteners, URL lenghteners, Twitter, Direct, Message, DM, spam, bit.ly, tinyurl, is.gd, cli.gs,, Long URL Please