Don't know if we count as big yet, but we're doing very very well: https://www.tinfoilsecurity.com
- Typed in a URL to get a free scan
- Needed to create an account
- Needed to confirm my email
- Needed to verify my site ownership
- Got a mail that my site is "borderline insecure". When I click on the link, I'm redirected to the "create an account view"
- Created a new account that opened in a half cropped Iframe displaying some error message I can't read.
This is where I finally gave up.
Better yet, it probably does that for any URL – see c8g's comment about Google, i've tried HN and a few of my own sites, all with the same results. Even tried to give it it's own address, but it "is not permitted".
So I thought that maybe it just displays that message after some timeout without doing any actual checks, bit like these sketchy fake antivirus sites. But nope – when i point it to a subdomain with access_log enabled, i see it actually makes a bunch of requests. So maybe they just have such high standards that the entire web is "borderline unsafe" from their point of view.
Even with no conflicts of interest at all, it's obvious that they would have higher security standards than anybody else out there.
You shouldn't have had to make a second account - that's the odd part. You do have to confirm your email, and we can't show you results until you've verified ownership, for legal reasons.
If you shoot me an email, I can definitely take a look at what happened with the account creation issues and fix it for you.
You might want to put a warning on there saying that it will submit any forms it can find a LOT.
Also, on the waiting screen, while it's running tests, I filled in the form and it's had an iframe drama.
https://www.dropbox.com/s/7rofi17cjormgav/Screenshot%202016-...
And thanks for the info on the iFrame - I'll look into that as well.
I'll definitely test that.
Also, please don't scan sites that aren't your own - you won't be able to see results anyway.