Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Payment Request API

w3.org

Post reply on HN
Print view View original

71–80 of 128 posts

Re: Payment Request API

#71

Post by gsnedders »

colejohnson66 wrote: post #62
jancsika wrote: post #42

Earlier quoted context omitted.

For certain decisions that seems like a false choice. For example, no amount of contribution would have stopped Netflix et al from pushing through EME as a web standard.

As bad as DRM is, EME is a good step towards killing Flash. And because of that, Netflix needs a replacement, and the studios aren’t just going to remove DRM requirements because Netflix says they won’t support DRM. I’m almost certain that if Netflix tried to remove DRM, the studios would balk and pull their content.

Or Netflix could take the route they took on iOS and just make native apps for everything.

Or, perhaps more likely, browser vendors would continue to not kill Flash until 2020 (at the earliest) when Adobe ends support, and then browsers would drop support for the insecure plugin and then Netflix would go the native apps route.

Re: Payment Request API

#72

Post by gsnedders »

objclxt wrote: post #46
swiley wrote: post #19

Earlier quoted context omitted.

The w3c seems to be run by people who make money on the web, not people who use the web.

> The w3c seems to be run by people who make money on the web, not people who use the web. Not really. Anyone can join the W3C, and anyone can participate in a working group / contribute to a standard. However, most people would agree that the balance of power effectively lies with the browser vendors. You can propose a standard all you like, but if you can't get a browser to adopt it then it's not going to get any t…

> However, most people would agree that the balance of power effectively lies with the browser vendors

It lies with two groups: the implementers (as nothing can become a standard without implementations, though there's plenty of precedent for using obscure ones!) and the W3C Members (i.e., the paying organisations who pay to get a seat; not those who contribute on mailing lists/GitHub/whatever, not those who are officially on the working groups as "invited experts") who ultimately vote on the proposed standard (and there Google has as much say as the BBC and Boeing and the University of Edinburgh.

Re: Payment Request API

#74

Post by gsnedders »

AdieuToLogic wrote: post #53
objclxt wrote: post #50

Earlier quoted context omitted.

> Furthermore, the fraud exposure presented by this API will be difficult to be accepted by processors. I'm confused by what you mean. The API doesn't have any additional fraud exposure. It uses existing payment instruments and methods. Also, all major card networks - Visa, MasterCard, AmEx - and many payment processors - Stripe, Worldpay, etc - all actively participate.

The API doesn't have any additional fraud exposure. The fraud exposure is due to identifying information, or access therein, being stored on and/or directly provided by the client in this model. Existing payment methods do not store billing information on the client devices as they are assumed to be untrusted. Also, all major card networks - Visa, MasterCard, AmEx - and many payment processors - Stripe, Worldpay, etc…

> Existing payment methods do not store billing information on the client devices as they are assumed to be untrusted.

Except this is exactly how Android Pay and Apple Pay work: they store the billing information on the client side. A large part of the impetus behind Payment Requests is to open up Android Pay and Apple Pay to the web. And all(?) major browsers support autofilling card details already, which means storing the billing information on the client side and exposing the web to that fraud risk.

And, heck, a conforming Payment Requests payment handler doesn't need to store anything locally: one based on payment cards could require you to enter the card details on every transaction.

Re: Payment Request API

#75

Post by dmitriid »

objclxt wrote: post #46
swiley wrote: post #19

Earlier quoted context omitted.

The w3c seems to be run by people who make money on the web, not people who use the web.

> The w3c seems to be run by people who make money on the web, not people who use the web. Not really. Anyone can join the W3C, and anyone can participate in a working group / contribute to a standard. However, most people would agree that the balance of power effectively lies with the browser vendors. You can propose a standard all you like, but if you can't get a browser to adopt it then it's not going to get any t…

> Anyone can join the W3C, and anyone can participate in a working group / contribute to a standard.

Starting at ~10 000 USD per year, sure

Re: Payment Request API

#76

Post by dmitriid »

baybal2 wrote: post #4

Why do we need to put a payment api into a browser?

Captain Obvious to the rescue: because people buy stuff online all the time. Global online retail market was 1.8 trillion dollars a year.

Something tells me that having a default secure way to pay is much better than everyone implementing (often poorly) their own solutions

Re: Payment Request API

#77

Post by kalleboo »

AdieuToLogic wrote: post #43
rictic wrote: post #10

Earlier quoted context omitted.

The problem it solves is reducing friction on checkout. For a super quick gist, watch 15 seconds of this video starting at this time: https://youtu.be/NDZw7vtoYnU?t=514

The problem it solves is reducing friction on checkout. One of the problems it creates is increasing the attack vector on an account holder by storing sensitive transaction information locally.

Don't all browsers and password managers already support credit card auto-fill? So it changes nothing from the status quo.

Re: Payment Request API

#78

Post by homakov »

noway421 wrote: post #27
StavrosK wrote: post #18

So there's now a protocol for the browser to transparently share payment data with websites but we still can't get something to let the browser transparently log us in to websites?

This became a thing lately: https://developers.google.com/web/updates/2016/04/credential...

Built in pw manager with JS api. Nothing special. Doesn't fix anything.

Re: Payment Request API

#79

Post by KyeRussell »

jancsika wrote: post #42
throwaway284534 wrote: post #22

Earlier quoted context omitted.

The W3C is run by the same peers who frequent this and other tech forums. You can help by contributing to the organization, or you could hope for some internet points with snarky remarks. Which do you want to be remembered for?

For certain decisions that seems like a false choice. For example, no amount of contribution would have stopped Netflix et al from pushing through EME as a web standard.

It's called pragmatism.

Re: Payment Request API

#80

Post by orf »

throwaway284534 wrote: post #22
swiley wrote: post #19

Earlier quoted context omitted.

The w3c seems to be run by people who make money on the web, not people who use the web.

The W3C is run by the same peers who frequent this and other tech forums. You can help by contributing to the organization, or you could hope for some internet points with snarky remarks. Which do you want to be remembered for?

Why not both?
Post reply on HN