The URL shortening services bit.ly and tinyurl.com return a 301 Moved Permanently HTTP status - ie. a URL redirect. The browser then sends a new request to the new (ie. long) URL, passing the referer again. AFAIK this is the same for most mainstream URL shortening services.
If the service performs a 301 redirect (as it should) then the browser repasses the referer. In this case I can see no reason for Google Analytics to not show this referer in its reports.
Note, however, that the browser itself can be configured to suppress the HTTP referer, or even send something completely erroneous.
Traffic coming form shortened urls like bit.ly, do they show up in
Google Analytics as direct or do they keep their real referrer?
They keep the real referer. This might also be "direct", if indeed it was a direct request.
Ex. If someone types in a bit.ly link it counts as direct, but if
someone clicks a bit.ly link from Twitter, it counts as referral
traffic from Twitter?
Yes. Note that twitter now wraps all its URLs in its own URL shortening service, so the referring URL is of the form http://t.co/xyzxyz.
An Example
The following shortened URLs all redirect to a page that shows the HTTP referer.
You can see that by following any of the above links, the HTTP referer is passed (providing your browser is set to do so). If you copy and paste the URL in a new browser window then no referer is passed - it is a direct link.
HTTPS - Secure connections
Just an additonal note about links from secure content (HTTPS) to non-secure content (HTTP) - this affects any kind of link, not just URL shorteners. In this case the HTTP referer header is not set by the browser.
Clients SHOULD NOT include a Referer header field in a (non-secure)
HTTP request if the referring page was transferred with a secure
protocol.
Source: RFC 2616 Section 15.1.3