Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New version of Stripe Checkout

stripe.com

Post reply on HN
Print view View original

141–150 of 162 posts

Re: New version of Stripe Checkout

#141

Post by genema »

cstejerean wrote: post #56
foobarbazetc wrote: post #46

Earlier quoted context omitted.

We thought this and killed our PayPal integration (went Stripe only) and lost double digits in sales (and received constant emails asking for PayPal). Unfortunately people want PayPal for whatever reason. Everything about PayPal from the merchant side sucks (bad API, bad recurring billing features, slow, no refund of fees for refunds from May, 6 months for someone to do a chargeback!, etc etc)

I use PayPal for random sites that I don’t know because I don’t like handing my credit card info to random websites. Now I would personally trust Stripe Checkout (especially on a stripe.con domain rather than in a modal) but that’s because I know Stripe. The dislike of PayPal among techies is not common the population at large in my experience. Another thing I use PayPal for is any kind of subscription, because I kno…

This is it exactly. I think for Stripe to really succeed in consumer space and not just among techies, they need to have a manageable back end for consumers to log in and be able to stop payments any time and allow for storing of cc info so people are not asked to enter it on a random website.

Re: New version of Stripe Checkout

#142

Post by CodeWriter23 »

TazeTSchnitzel wrote: post #136
CodeWriter23 wrote: post #100

Earlier quoted context omitted.

As devs, we know in theory Stripe and PayPal are roughly equivalent in terms of protecting a card number. But the streamlined Stripe UI with the subtle branding doesn't drive home to the customer that Stripe is keeping your card number safe vs. random merchant storing all 16 digits in a hackable database somewhere. The friction in the PayPal UI of making you log in to PayPal to make the payment is a pretty big trust…

Stripe isn't as safe. PayPal collects my details only on paypal.com, Stripe collects my details on all sorts of domains, where who-knows-what JS might be present.

Are you speaking about real threats that cannot be mitigated by best practices, or theoretical threats of the future? I guess in other words, I’m under the impression using Stripe and following OWASP and script signing that my customers are safe. If I’m incorrect please pass me a clue.

Re: New version of Stripe Checkout

#143

Post by jjevanoorschot »

ianhawes wrote: post #7

This is a beautiful user interface, but in my business, ~40% of our payments are through PayPal. To integrate Stripe Checkout, we would have to ask the customer whether they're paying with a card or using PayPal prior to displaying the Stripe UI. While that is not the worst option, our current UX is similar to Shopify, where there is an accordion component with multiple options: PayPal, Credit Card, Apple Pay, etc..…

Recently PayPal stopped allowing Adyen, one of the biggest payment service providers, to integrate with their platform. I'm not quite sure that integrating with PayPal is an option for Stripe, and even if it technically were an option, I'm sure it wouldn't be an economically viable one.

Re: New version of Stripe Checkout

#144

Post by jjevanoorschot »

regecks wrote: post #139
cromulent wrote: post #96

For people impacted by SCA in a few months time (EU) this is really nice. SCA: https://stripe.com/en-US/guides/strong-customer-authenticati... EU e-commerce credit card transactions currently often redirect to the bank providing your card to authenticate before accepting the payment. The UX is very poor. The beneficiary of the check is the bank, but they tell you it is done for your own security. For some reason, fin…

Just to be sure, if your business is domiciled outside of the EU (e.g. Australia), there is nothing to be done regarding SCA, right? In other words, there's no risk with sticking to Stripe Checkout Legacy, even for European cards? I have read some contradicting documentation. [1] states the business AND customer must be in EU ("if all of the following apply"), [2] says "payments to European businesses or from Europea…

You are correct, it's a "two legs in" rule. SCA only applies if both the merchant and the customer are based in the EU.

Re: New version of Stripe Checkout

#145

Post by jjevanoorschot »

nailer wrote: post #26
bpicolo wrote: post #23

Earlier quoted context omitted.

They have the embedded option as well: https://stripe.com/docs/stripe-js#stripejs-and-elements This change seems to solidify the distinction between Stripe-hosted vs self-hosted

Anyone got any thoughts on when to use Elements vs the new Checkout?

Use Checkout unless you have a good reason not to. The main benefit is that if there is any large change in regulation (like SCA right now in the EU), Stripe will update Checkout and you will not have to change anything.

Re: New version of Stripe Checkout

#146

Post by chrispadfield »

jimnotgym wrote: post #86
chrispadfield wrote: post #70

Any support for EU VAT handling coming to this? A lot of work seems to have gone into European support here - odd that VAT handling not part of that.

This would be a big deal. Even Shopify haven't got this to work

It's not clear to me why it's so hard. We've built it ourselves, but it's annoying having to redo the logic for smaller projects.

Re: New version of Stripe Checkout

#147

Post by danpalmer »

stickfigure wrote: post #20
danpalmer wrote: post #15

Earlier quoted context omitted.

> Stripe wants to fetch a premium with this feature. As such, they should bite the bullet and allow merchants to integrate PayPal as a secondary option (similar to how Apple Pay is displayed). I expect this is not Stripe's decision. PayPal own Braintree, a Stripe competitor, whos unique selling point is that they also support PayPal through one API. I suspect PayPal want to keep this distinction. Without support from…

Before PayPal bought Braintree, they were a separate company that provided the same service (cards & paypal as an option). Presumably they did this using PayPal's APIs - I'm familiar enough with them to think it should be possible for anyone. However, those APIs are horrible and PayPal's technology platform is a trainwreck, so I can understand why they might not be rushing it out.

The APIs may be available, but I'd expect the terms of use of those APIs will say something about not using them for competing businesses or some language that could be used to exclude Stripe from being able to offer it as an integration.

There are rumours that Stripe _are_ working on PayPal integration, but I expect this would only launch with PayPal's blessing through some business deal, not just from Stripe's work.

Re: New version of Stripe Checkout

#148

Post by kalleboo »

CodeWriter23 wrote: post #142
TazeTSchnitzel wrote: post #136

Earlier quoted context omitted.

Stripe isn't as safe. PayPal collects my details only on paypal.com, Stripe collects my details on all sorts of domains, where who-knows-what JS might be present.

Are you speaking about real threats that cannot be mitigated by best practices, or theoretical threats of the future? I guess in other words, I’m under the impression using Stripe and following OWASP and script signing that my customers are safe. If I’m incorrect please pass me a clue.

As a customer, how do I verify that the merchant is following best practices and hasn't by mistake forgotten some ad script enabled on the payment page?

With PayPal as long as I only enter my password on paypal dot com I know I'm safe.

Re: New version of Stripe Checkout

#149

Post by kalleboo »

regecks wrote: post #139
cromulent wrote: post #96

For people impacted by SCA in a few months time (EU) this is really nice. SCA: https://stripe.com/en-US/guides/strong-customer-authenticati... EU e-commerce credit card transactions currently often redirect to the bank providing your card to authenticate before accepting the payment. The UX is very poor. The beneficiary of the check is the bank, but they tell you it is done for your own security. For some reason, fin…

Just to be sure, if your business is domiciled outside of the EU (e.g. Australia), there is nothing to be done regarding SCA, right? In other words, there's no risk with sticking to Stripe Checkout Legacy, even for European cards? I have read some contradicting documentation. [1] states the business AND customer must be in EU ("if all of the following apply"), [2] says "payments to European businesses or from Europea…

The article linked in the previous comment says

> While SCA is not legally required for businesses outside of Europe, we expect a small minority of European banks to require SCA for all payments regardless of where a business is located

I can believe this since the debit card associated with one of my european banks will only allow online transactions with 3DSecure.

Post reply on HN