Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Recurly.js library released for secure, customizable checkout forms

js.recurly.com

Post reply on HN
Print view View original

11–20 of 41 posts

Re: Recurly.js library released for secure, customizable checkout forms

#11

Post by pbreit »

sfjustin wrote: post #8
pbreit wrote: post #4

PayPal should have been doing this years ago. Kudos to Recurly for bringing this to the public in front of Stripe which is still private.

CheddarGetter has had this feature for awhile.

I just looked and wasn't able to find it. For one, CheddarGetter looks to be a hosted provider whereas Recurly and Stripe support buyers remaining on the merchant's web pages. But the main feature I was referencing was a JavaScript library that handles credit card information so that the merchant never sees a credit card number and thus need not worry about PCI compliance. That historically has not been provided in a way that allows the payer to remain on the merchant's web page.

Re: Recurly.js library released for secure, customizable checkout forms

#12

Post by pbreit »

drivebyacct2 wrote: post #10
isaachall wrote: post #9

Earlier quoted context omitted.

The Recurly.js library dramatically reduces PCI compliance scope because the sensitive cardholder data does not pass thru your servers. There's a lot of additional PCI compliance issues when the credit card numbers pass thru your server, even if it only resides in memory during the request. Instead, the data is sent directly from the web browser to Recurly, who is PCI Level 1 Compliant. Obviously, you still have to m…

... which thus precludes the security (and thus simplicity) aspect of Recurly.js.

Recurly still supports hosted payment pages in which case the merchant doesn't need SSL.

As far as I know, Recurly and Stripe are the only two processors providing JavaScript libraries to tokenize credit card information such that merchants do not handle the credit card information that suscepts them to PCI compliance.

Re: Recurly.js library released for secure, customizable checkout forms

#13

Post by trungonnews »

isaachall wrote: post #9
trungonnews wrote: post #6

How is this PCI compliance? You're exposing credit card number on the input field of the original publisher's HTML page. This means that the publisher can pick up the credit card number himself, or an included third party javascript library(like google analytics).

The Recurly.js library dramatically reduces PCI compliance scope because the sensitive cardholder data does not pass thru your servers. There's a lot of additional PCI compliance issues when the credit card numbers pass thru your server, even if it only resides in memory during the request. Instead, the data is sent directly from the web browser to Recurly, who is PCI Level 1 Compliant. Obviously, you still have to m…

You're missing the point.

While the user is entering the credit card number, there's a chance that someone can intercept and steal the CC.

You can easily solve this problem by putting the credit card form inside your own iframe. :)

Re: Recurly.js library released for secure, customizable checkout forms

#14

Post by jcc80 »

pbreit wrote: post #11
sfjustin wrote: post #8

Earlier quoted context omitted.

CheddarGetter has had this feature for awhile.

I just looked and wasn't able to find it. For one, CheddarGetter looks to be a hosted provider whereas Recurly and Stripe support buyers remaining on the merchant's web pages. But the main feature I was referencing was a JavaScript library that handles credit card information so that the merchant never sees a credit card number and thus need not worry about PCI compliance. That historically has not been provided in a…

I think Braintree does it, kind of: "By using our Transparent Redirect (TR) and Vault, merchants can achieve PCI Compliance in days. TR and the Vault will eliminate the handling, processing or storing credit card data so you can qualify for the Self Assessment Questionnaire A, the shortest of the four SAQs."

http://www.braintreepayments.com/services/pci-compliance

edit: So, w/ Recurly I wonder if it's the same thing and I'd need to do the Self Assessment Questionnaire A when using recurly.js

Re: Recurly.js library released for secure, customizable checkout forms

#15

Post by trungonnews »

pbreit wrote: post #12
drivebyacct2 wrote: post #10

Earlier quoted context omitted.

... which thus precludes the security (and thus simplicity) aspect of Recurly.js.

Recurly still supports hosted payment pages in which case the merchant doesn't need SSL. As far as I know, Recurly and Stripe are the only two processors providing JavaScript libraries to tokenize credit card information such that merchants do not handle the credit card information that suscepts them to PCI compliance.

socialgold had a similar product before google acquired it.

Re: Recurly.js library released for secure, customizable checkout forms

#16

Post by isaachall »

jcc80 wrote: post #14
pbreit wrote: post #11

Earlier quoted context omitted.

I just looked and wasn't able to find it. For one, CheddarGetter looks to be a hosted provider whereas Recurly and Stripe support buyers remaining on the merchant's web pages. But the main feature I was referencing was a JavaScript library that handles credit card information so that the merchant never sees a credit card number and thus need not worry about PCI compliance. That historically has not been provided in a…

I think Braintree does it, kind of: "By using our Transparent Redirect (TR) and Vault, merchants can achieve PCI Compliance in days. TR and the Vault will eliminate the handling, processing or storing credit card data so you can qualify for the Self Assessment Questionnaire A, the shortest of the four SAQs." http://www.braintreepayments.com/services/pci-compliance edit: So, w/ Recurly I wonder if it's the same thing…

With Recurly.js and our Transparent Post, merchants only need to fill out the Self Assessment Questionnaire A.

We launched our own Transparent Post back in March 2011. We created Recurly.js to simplify performing client-side validation, pricing calculations (w/ coupons, VAT, add-ons), and proper error handling when a transaction is declined. It's 10x easier to implement than Transparent Post, and has a much better user experience for the customer.

Re: Recurly.js library released for secure, customizable checkout forms

#18

Post by tptacek »

trungonnews wrote: post #6

How is this PCI compliance? You're exposing credit card number on the input field of the original publisher's HTML page. This means that the publisher can pick up the credit card number himself, or an included third party javascript library(like google analytics).

I think this is absolutely true, but my understanding is that the PCI powers-that-be are OK with it. If the credit card numbers are by design not hitting your server, you don't need an audit. Yet another reason why we've avoided doing PCI stuff.

These forms sure are pretty though.

Re: Recurly.js library released for secure, customizable checkout forms

#19

Post by tptacek »

trungonnews wrote: post #13
isaachall wrote: post #9

Earlier quoted context omitted.

The Recurly.js library dramatically reduces PCI compliance scope because the sensitive cardholder data does not pass thru your servers. There's a lot of additional PCI compliance issues when the credit card numbers pass thru your server, even if it only resides in memory during the request. Instead, the data is sent directly from the web browser to Recurly, who is PCI Level 1 Compliant. Obviously, you still have to m…

You're missing the point. While the user is entering the credit card number, there's a chance that someone can intercept and steal the CC. You can easily solve this problem by putting the credit card form inside your own iframe. :)

Madness. Are users expected to check the DOM tree before they type their credit card details in to make sure they're sending their info to the iframe they expect to?

The rule should be: if your app has a credit card form under its own banner, the whole thing is implicated for PCI assessments. But that's not the rule.

Re: Recurly.js library released for secure, customizable checkout forms

#20

Post by jcc80 »

isaachall wrote: post #16
jcc80 wrote: post #14

Earlier quoted context omitted.

I think Braintree does it, kind of: "By using our Transparent Redirect (TR) and Vault, merchants can achieve PCI Compliance in days. TR and the Vault will eliminate the handling, processing or storing credit card data so you can qualify for the Self Assessment Questionnaire A, the shortest of the four SAQs." http://www.braintreepayments.com/services/pci-compliance edit: So, w/ Recurly I wonder if it's the same thing…

With Recurly.js and our Transparent Post, merchants only need to fill out the Self Assessment Questionnaire A. We launched our own Transparent Post back in March 2011. We created Recurly.js to simplify performing client-side validation, pricing calculations (w/ coupons, VAT, add-ons), and proper error handling when a transaction is declined. It's 10x easier to implement than Transparent Post, and has a much better us…

Thanks for spelling that out for me. As for being simple - I have begun teaching myself somewhat recently while looking for a good match w/ someone more technical. I can really only handle html & css at this point - sad I know. Anyways, this was very easy for me to setup. I've already got it going on my site w/ sandbox account.

But, going to hold off for now and just use hosted payment pages for a bit. Will likely use this in the near future though - thanks to the Recurly team.

Post reply on HN