Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pin is Australia’s first all-in-one payment API

pin.net.au

Post reply on HN
Print view View original

41–50 of 97 posts

Re: Pin is Australia’s first all-in-one payment API

#41

Post by boundlessdreamz »

mvboeke wrote: post #37
djtidau wrote: post #11

I can't tell you how happy I am to see this. I was excited to hear about Braintree expanding to Australia a couple of days ago, but this is much more promising. Do you have plans to incorporate recurring charges as well? I've added myself to the invite list.

I would be curious to know why you think this looks more promising than Braintree. Disclosure: I work at Braintree. I'm not trying to shill here - I'm genuinely curious about how people think about our stuff vs. other payments companies.

Kinda offtopic: But since you work at braintree, please have a look at my comment http://news.ycombinator.com/item?id=4069105

Re: Pin is Australia’s first all-in-one payment API

#43

Post by [deleted] »

asharp wrote: post #40
Cogito wrote: post #27

Earlier quoted context omitted.

This was exactly what I thought as well. Using an HTTPS connection is all well and good, but it is not enough. HTTPS is susceptible to man in the middle attacks [1], and securing the params with a pre-shared secret key is essential. The extra cost in 'complexity' is really far outweighed by the (warranted) extra security. [1] http://www.thoughtcrime.org/software/sslstrip/

Would you mind elaborating? ssltrip requires a valid root ca, or an ssl library that doesn't check the signing chain. After using it though, the parameters are unencrypted and so can simply be sniffed. Are you attempting to reencrypt the parameters with another key? If so then why run that through https?

[deleted]

Re: Pin is Australia’s first all-in-one payment API

#44

Post by johnrob »

mattmanser wrote: post #22

Something sticks out like a sore thumb in that API. Where's the param signing with a secret key?

I can't see any point in signing the params - an attacker only cares about the CC info, not some hash value. The only use for a secret key would be to encrypt all the params. But SSL already does that...

Re: Pin is Australia’s first all-in-one payment API

#46

Post by Aqua_Geek »

asharp wrote: post #40
Cogito wrote: post #27

Earlier quoted context omitted.

This was exactly what I thought as well. Using an HTTPS connection is all well and good, but it is not enough. HTTPS is susceptible to man in the middle attacks [1], and securing the params with a pre-shared secret key is essential. The extra cost in 'complexity' is really far outweighed by the (warranted) extra security. [1] http://www.thoughtcrime.org/software/sslstrip/

Would you mind elaborating? ssltrip requires a valid root ca, or an ssl library that doesn't check the signing chain. After using it though, the parameters are unencrypted and so can simply be sniffed. Are you attempting to reencrypt the parameters with another key? If so then why run that through https?

> Are you attempting to reencrypt the parameters with another key? If so then why run that through https?

I think they are talking about generating a hash from all of the parameters in the request + a secret, pre-shared key. Doing so prevents MITM attacks from changing the parameters.

IIRC, Amazon does this (among many others).

Re: Pin is Australia’s first all-in-one payment API

#47

Post by 10dpd »

Can someone explain why a separate payment system is needed for Australian developers? My nieve understanding is that credit cards are global from a consumer perspective (i.e. a credit card will work in any country in the world). Are things different from a developer perpective? If so, why?

Re: Pin is Australia’s first all-in-one payment API

#48

Post by jbrendel »

I'll say "thank you" after I know more about the pricing and fees and how long it will take before my money appears in my bank account. It's great that you are setting up something like this and I really hope for the best. Would love to use it, but as others have commented, down here we are used to being ripped off, so when I see "monthly charges", I'm already a bit weary. Still hopeful, but a bit concerned.

Also, I really hope this will work for Kiwis as well?

Re: Pin is Australia’s first all-in-one payment API

#49

Post by jbrendel »

jkahn wrote: post #12

Looks fantastic. I'm interested already and we don't have an immediate need for the API - but even the web UI looks great. Very little information on your site, though. Some questions strike me: - What path does the money take from the customer to the user of your service (e.g. me), and how long does it take to get there? - What kind of backing/insurance/licenses do you have? If you're a tiny startup, there's risk fo…

Very good points. I hope you will put up more substantial information on your web site.

Consider that we are supposed to trust you with our customer's credit card information, their and our money. Currently I'm thinking: Who are you and why should I trust you? There is no information on your site which would give me any confidence. I'm sure you have all the info, but please share it with us.

Re: Pin is Australia’s first all-in-one payment API

#50

Post by jusben1369 »

10dpd wrote: post #47

Can someone explain why a separate payment system is needed for Australian developers? My nieve understanding is that credit cards are global from a consumer perspective (i.e. a credit card will work in any country in the world). Are things different from a developer perpective? If so, why?

There are two sides to the equation. Owning a credit card and using it and b) accepting a credit card and processing money. The latter part is all driven by local/national banks and rules and regulations.
Post reply on HN