I Know the Shortened URLs You Clicked on Twitter: Inference Attack using Public Click Analytics and Twitter

Twitter is a popular social network service for sharing mes-sages among friends. Because Twitter restricts the length of messages, many Twitter users use URL shortening services, such as bit.ly and goo.gl, to share long URLs with friends. Some URL shortening services also provide click analytics of the shortened URLs, including the number of clicks, coun-tries, platforms, browsers and referrers. To protect visitors’ privacy, they do not reveal identifying information about in-dividual visitors. In this paper, we propose a practical attack technique that can infer who clicks what shortened URLs on Twitter. Unlike the conventional browser history steal-ing attacks, our attack methods only need publicly available information provided by URL shortening services and Twit-ter. Evaluation results show that our attack technique can compromise Twitter users ’ privacy with high accuracy