Google and Microsoft shortened URLs make it easy to spy on people

Cornell Tech’s Martin Georgiev and Vitaly Shmatikov on Thursday published the results of an 18-month study that found the 5- or 6-character tokens added to domains such as or are so short, all possible URLs can be scanned by brute force by “anyone with a little patience and a few machines at her disposal.” Those short URLs are, in effect, public, the researchers say.