A secure, persistent and privacy preserving link shortener for research and education

Link shorteners reduce a lengthy URL on the internet to something short and snappy, and sometimes easy to remember. As such it is a very well used and liked functionality within our community.

Many ‘free’ link shorteners exist, however, their free nature comes with a number of challenges, including:

• serving advertisements during the creation of the link, or when a link is followed and
• placing all kinds of tracking and fingerprinting, in that way data mining the users and their interests.

Next to these practices, some more general challenges exist with link shorteners, which are especially challenging for our sector:

• Many free link shorteners have a limited lifetime for the links they present. This leads to links being lost, or in some cases links being reassigned to different content. This lifetime is especially challenging in cases where the link shortener was used to reference scientific articles, where the intent is to long term preserve the relation between the article and the references. 
• Due to its proxy like nature, it is impossible to known where the link will actually lead. This makes link shorteners very ‘interesting’ tools to lure people into selecting links that lead to e.g. malware.
• Branding and policies of the free link shortener may not align well with the values of the institution the user is representing.

Taking into account the above considerations, SURF developed a new service called “edu.nl”. Grown out of a ‘Friday afternoon’ project, the edu.nl link shortener service was launched in The Netherlands in Oct 2019 to see its popular rise sharply in the two first months after it was moved from being a SURF staff only service to become a broadly available community service. The software supporting edu.nl will be made available to the GÉANT community by SURF for the purpose of this project.

This incubator project seeks to enhance the capabilities of the existing edu.nl codebase and make them ready for purpose to deliver a service that could be operated for the benefit of the GÉANT community as a whole, branded as the eduLNK service.

Assuming the eduLNK service would offer a free to use service for end users in our community to resolve and mitigate some of the aforementioned issues:

• By making the software available to GEANT project and teh NRENs, the service is to be operated by a trusted third party without a need to make a profit from operating the service. This removes the need for advertising or selling off personal data.
• The eduLNK service will actively protect and preserve end user privacy and limit the amount of personal data collected to the absolute minimum.
• By allowing only community members to create short links, the edulnk.org link shortener is much more trusted as compared to other link shorteners. Also, the eduLNK operator may act upon abuse and engage with the users institution to resolve such issue as part of its acceptable use policy.
• eduLNK will offer long lifetimes for links before they expire. While storing links for a long time will take some effort, it is noted that the price of storage are rather low.

• The activity will enhance the existing software  as described in the technical details section below. The result will be made available to the NREN community as open source software
• The activity will investigate the possibility of making the eduLNK a centrally operated GEANT service.

The features below are currently not yet supported in the software developed by SURF.
This incubator activity will add these and contribute them back to the software project.

• eduLNK will use InAcademia community edition to verify if a user is a member of the R&E community
• The eduLNK service will try to actively filter out known dangerous links, reducing the risk of exposing users to malware and other treats
  
• The service may be supported in as many languages as the community is willing to provide support for
  
• Update / change link by end users

For institutions in the GÉANT community, eduLNK offers additional capabilities:

• An institution may add their own preferred domain name to the link shortener, so they can align this usage with institutional policies and branding. To add a domain, they will have to prove they own the domain. For end users coming from institutions which support the use of their own domain, they may choose to use either the institutional selected domain or the eduLNK domain name as part of their link shortener
  
• For any domain added by an institution, the institution has the ability to download and thus preserve the links made by their users using the institutionally provided domain. This allows institutions to preserve the links even in case the eduLNK service itself would end its service
  

• Due to the time-boxed nature of an incubator activity, we may not be able to complete all envisioned work. To mitigate we work closely with the stakeholders to make sure features with the highest priority get implemented first.
• This activity aspires to find a way to have this software operated centrally as part of the GEANT project. There are however many factor that determine if that is possible. As a mitigation we will also make the software available as open source so individual NRENs may deploy it themselves.

This activity is completed is the following goals are met:

Enhancing the software:

• Make use of InAcademia community edition
• Actively filter out known dangerous links
  
• Supported miltiple languages
  
• Allow users to update / change links
• Allow institution to use eduLNK with their own domain and branding

Te software developed as part of this activity will be made available under an open source licence.

This activity will investigate if eduLNK may be offered as a GEANT service.

This activity is work in progress at the time of writing.