Exercise 3: Why a Shortened Link in a Text Is Unverifiable by Default — Possible Solution
====================================================================

WHAT THIS CHAPTER SAYS
------------------------------
Per this chapter's warn-box, "on email, a suspicious full URL is at
least visible before you click. A shortened link gives you nothing to
inspect at all until you've already followed it - treat any shortened
link in an unsolicited text as unverifiable by default, not just
'worth a second look.'"

THE KEY DIFFERENCE: WHAT YOU CAN SEE BEFORE COMMITTING
------------------------------
With a full URL (as in the email example, Exercise 1), the real
destination domain is visible right there in the text or the raw HTML
- you can evaluate it without visiting it. A shortened link
(`bit.ly/...`, `t.co/...`) hides the real destination behind the
shortening service itself; there is no visible information to evaluate
at all until you've already clicked through, at which point any
"checking" happens after the risk, not before it.

WHY THIS ISN'T THE SAME KIND OF RED FLAG AS THE OTHERS
------------------------------
Most red flags in this chapter (urgency, generic greetings, near-right
branding) are things you weigh alongside other evidence - a message
can have one or two of these and still turn out legitimate. A
shortened link is different: it isn't evidence that adds to a
judgment call, it's the literal absence of the one piece of
information (the real destination) needed to make that judgment call
at all. There's nothing to weigh, because there's nothing to inspect.

WHY "UNVERIFIABLE BY DEFAULT" IS THE RIGHT STANDARD
------------------------------
Since the real destination can't be known without already taking the
risk, the only responsible stance is to treat the link as guilty until
proven otherwise (e.g., by contacting the sender through a separate,
known-good channel) - not to give it the benefit of the doubt the way
you might weigh a slightly-off logo or a somewhat urgent tone.

WHY THIS WORKS AS AN ANSWER
------------------------------
It explains the specific difference between a full URL and a
shortened one (visible destination vs. none at all), explains why that
makes a shortened link categorically different from the chapter's
other, weighable red flags, and explains why treating it as
unverifiable by default follows directly from that difference.