Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How I Made $350 In Two Days With Three Pages and Some Payment Code

dshipper.posterous.com

Post reply on HN
Print view View original

51–60 of 90 posts

Re: How I Made $350 In Two Days With Three Pages and Some Payment Code

#51

Post by InclinedPlane »

NinetyNine wrote: post #40
dshipper wrote: post #25

Earlier quoted context omitted.

Thanks! Yes there is a chance for a MITM attack but as far as I understand from talking to Stripe that risk is very, very low. I'm going to be adding SSL this week anyway however. Thanks for your comment!

Wouldn't it be vulnerable to simple eavesdropping? SSL can be attacked via MITM, but since certificates are authenticated your browser knows when it occurs. (I still don't know quite how that works)

SSL can't be MITMed because SSL certs need to be signed by a certificate authority, and those signatures can be checked against pre-loaded public keys in the browser (CA certs). However, if the serving page is non-SSL that then posts via SSL then it's possible for a MITM attack to hijack the connection and display a new page that posts to some other location (where the credit card numbers are collected, etc.) without the user's becoming aware of it easily.

Re: How I Made $350 In Two Days With Three Pages and Some Payment Code

#52

Post by dshipper »

simonista wrote: post #49

I'm curious how you got into the stripe beta? Had you used them before with other projects?

I just sent them an email...they're great guys. I just got some invites to it so send me an email (address is in my profile) and I'll give you one.

Re: How I Made $350 In Two Days With Three Pages and Some Payment Code

#53

Post by mixmastamyk »

nodata wrote: post #46
dshipper wrote: post #25

Earlier quoted context omitted.

Thanks! Yes there is a chance for a MITM attack but as far as I understand from talking to Stripe that risk is very, very low. I'm going to be adding SSL this week anyway however. Thanks for your comment!

It doesn't matter if the risk is low, the impact is high. Your customers will see you don't want to shell out 12 bucks for an SSL certificate to protect them.

Which provider do you recommend for a such a cheap cert that is accepted by a large percentage of browsers?

Re: How I Made $350 In Two Days With Three Pages and Some Payment Code

#54

Post by dshipper »

mixmastamyk wrote: post #53
nodata wrote: post #46

Earlier quoted context omitted.

It doesn't matter if the risk is low, the impact is high. Your customers will see you don't want to shell out 12 bucks for an SSL certificate to protect them.

Which provider do you recommend for a such a cheap cert that is accepted by a large percentage of browsers?

http://www.comodo.com/e-commerce/ssl-certificates/free-ssl-c...

Re: How I Made $350 In Two Days With Three Pages and Some Payment Code

#55

Post by nodata »

mixmastamyk wrote: post #53
nodata wrote: post #46

Earlier quoted context omitted.

It doesn't matter if the risk is low, the impact is high. Your customers will see you don't want to shell out 12 bucks for an SSL certificate to protect them.

Which provider do you recommend for a such a cheap cert that is accepted by a large percentage of browsers?

http://www.gandi.net/ssl/grid

Re: How I Made $350 In Two Days With Three Pages and Some Payment Code

#56

Post by almost »

jvdongen wrote: post #50
NinetyNine wrote: post #40

Earlier quoted context omitted.

Wouldn't it be vulnerable to simple eavesdropping? SSL can be attacked via MITM, but since certificates are authenticated your browser knows when it occurs. (I still don't know quite how that works)

How that exactly works is a bit too long a topic for a comment here (try google - "public key encryption", "X.509" and "certificate authority" are some relevant search terms if you're interested). However what I'd like to point out is that 'simple eavesdropping' effectively is a Man-In-The-Middle attack, be it a passive one (the man in the middle is just keeping his mouth shut and only listening). And eavesdropping o…

Unless the user is using public wifi. Then eavesdropping is pretty easy. I would imagine its very much a not hugely hard possibility on WEP secured wifi networks too.

Re: How I Made $350 In Two Days With Three Pages and Some Payment Code

#57

Post by jcc80 »

angryasian wrote: post #28
jamesgagan wrote: post #6

CrowdPicker has been doing this for awhile: http://www.crowdpicker.com/

other sites doing very similar things pickfu.com usertesting.com feedbackarmy.com

I've used pickfu a few times - usually get results in 24 hours. I'm bad with colors so it's nice to be able to ask 50 people for $5 which look they like better of a site. It's great because I want real feedback - great when people really tell you if they hate something instead of getting the real world "Oh, nice" responses.

Also used it to ask about domain names.

Edit: I like the site - good layout & like the KISS approach. Good luck.

Re: How I Made $350 In Two Days With Three Pages and Some Payment Code

#58

Post by icode »

nodata wrote: post #46
dshipper wrote: post #25

Earlier quoted context omitted.

Thanks! Yes there is a chance for a MITM attack but as far as I understand from talking to Stripe that risk is very, very low. I'm going to be adding SSL this week anyway however. Thanks for your comment!

It doesn't matter if the risk is low, the impact is high. Your customers will see you don't want to shell out 12 bucks for an SSL certificate to protect them.

How is the impact high?

You pay everywhere with your credit card. Everytime you buy something with your credit card number, the site you put it in can make a copy of it. Has the number any value at all?

Re: How I Made $350 In Two Days With Three Pages and Some Payment Code

#59

Post by Confusion »

nodata wrote: post #46
dshipper wrote: post #25

Earlier quoted context omitted.

Thanks! Yes there is a chance for a MITM attack but as far as I understand from talking to Stripe that risk is very, very low. I'm going to be adding SSL this week anyway however. Thanks for your comment!

It doesn't matter if the risk is low, the impact is high. Your customers will see you don't want to shell out 12 bucks for an SSL certificate to protect them.

Unfortunately, the vast majority of customers will not notice that at all.

Re: How I Made $350 In Two Days With Three Pages and Some Payment Code

#60

Post by Confusion »

InclinedPlane wrote: post #51
NinetyNine wrote: post #40

Earlier quoted context omitted.

Wouldn't it be vulnerable to simple eavesdropping? SSL can be attacked via MITM, but since certificates are authenticated your browser knows when it occurs. (I still don't know quite how that works)

SSL can't be MITMed because SSL certs need to be signed by a certificate authority, and those signatures can be checked against pre-loaded public keys in the browser (CA certs). However, if the serving page is non-SSL that then posts via SSL then it's possible for a MITM attack to hijack the connection and display a new page that posts to some other location (where the credit card numbers are collected, etc.) without…

In theory, yes. In practice, many CA authorities have probably leaked their keys. The recent publicly known cases are only the tip of the iceberg.
Post reply on HN