Payment iframe - the easiest way to insert Stripe into your website • Hacker News Board

Re: Payment iframe - the easiest way to insert Stripe into your website

#21

Post by cperciva » Mon, Aug 13, 2012, 4:50 PM UTC

ceejayoz wrote: post #19

cperciva wrote: post #18

Earlier quoted context omitted.

It's available for people to use if they want, sure. I expect Stripe to offer a similar service soon too (at which point that issue goes away, since people are already trusting Stripe with their card details). I'm trusting people to decide which risks they want to take -- I'm providing tools, not dictating policy.

Maybe the FAQ should include a "Q: Why should I trust your domain to host this for me? A: You shouldn't. This is a sample, you should implement it yourself for security."

Good point, added. I thought it was obvious, but given some of the comments here, I guess it wasn't obvious enough.

Re: Payment iframe - the easiest way to insert Stripe into your website

#22

Post by cperciva » Mon, Aug 13, 2012, 4:54 PM UTC

kevinsimper wrote: post #20

This may be even more unsecure. Who would like their user to put in their creditcard information on a unknown site? The change for that paymentiframe.com get comprimised I see is way higher, than Stripe is getting comprimised.

The [chance] for that paymentiframe.com get compromised I see is way higher, than Stripe is getting compromised.

We'll have to agree to disagree about that. Not that there's anything wrong with Stripe's security, but I know a little bit about the subject too. :-)

Re: Payment iframe - the easiest way to insert Stripe into your website

#23

Post by gatordan » Mon, Aug 13, 2012, 4:55 PM UTC

I have to agree with everyone here that this doesn't make sense. I'm currently working on integrating Stripe into my application to create a subscription system. By far the easiest part has been payment form. In their tutorial they have a basic form that you can plug into a .html file and create test customers within minutes. It's laid out in 3 well documented steps in that link he calls "daunting".

Re: Payment iframe - the easiest way to insert Stripe into your website

#24

Post by estel » Mon, Aug 13, 2012, 5:01 PM UTC

Would using this service affect one's PCI DSS compliance?

Re: Payment iframe - the easiest way to insert Stripe into your website

#25

Post by DASD » Mon, Aug 13, 2012, 5:02 PM UTC

bentlegen wrote: post #16

Please don't use this. There is nothing stopping paymentiframe.com from taking your customer's credit card numbers.

Ben, Are you going to be addressing this in your book, Third Party Javascript? Would love to hear your recommendations for how to handle payment processing such as this.

Re: Payment iframe - the easiest way to insert Stripe into your website

#26

Post by cperciva » Mon, Aug 13, 2012, 5:02 PM UTC

estel wrote: post #24

Would using this service affect one's PCI DSS compliance?

Not based on my understanding of PCI DSS.

Re: Payment iframe - the easiest way to insert Stripe into your website

#27

Post by jellicle » Mon, Aug 13, 2012, 5:18 PM UTC

cperciva wrote: post #26

estel wrote: post #24

Would using this service affect one's PCI DSS compliance?

Not based on my understanding of PCI DSS.

Merchants are either required to be PCI DSS compliant themselves or outsource their card-handling only to third-party entities who are PCI DSS compliant themselves.

So, one of two things is true:

-- Paymentiframe/tarsnap is a PCI DSS compliant third party

-- the merchant is intentionally violating the PCI DSS rules by sending credit card data to you

So, which is it?

Re: Payment iframe - the easiest way to insert Stripe into your website

#28

Post by cperciva » Mon, Aug 13, 2012, 5:21 PM UTC

jellicle wrote: post #27

cperciva wrote: post #26

Earlier quoted context omitted.

Not based on my understanding of PCI DSS.

Merchants are either required to be PCI DSS compliant themselves or outsource their card-handling only to third-party entities who are PCI DSS compliant themselves. So, one of two things is true: -- Paymentiframe/tarsnap is a PCI DSS compliant third party -- the merchant is intentionally violating the PCI DSS rules by sending credit card data to you So, which is it?

Nobody is sending credit card data to me. I'm serving up a form with javascript which sends the credit card data directly to Stripe.

Re: Payment iframe - the easiest way to insert Stripe into your website

#29

Post by bentlegen » Mon, Aug 13, 2012, 5:36 PM UTC

DASD wrote: post #25

bentlegen wrote: post #16

Please don't use this. There is nothing stopping paymentiframe.com from taking your customer's credit card numbers.

Ben, Are you going to be addressing this in your book, Third Party Javascript? Would love to hear your recommendations for how to handle payment processing such as this.

The book describes techniques that Stripe could use in developing their own iframed credit card form. I'd only trust a solution from them directly.

Re: Payment iframe - the easiest way to insert Stripe into your website

#30

Post by mrgreenfur » Mon, Aug 13, 2012, 5:37 PM UTC

This is a lovely form. Ideally, Stripe would offer something like this as a way to quickly generate a nice cc entry form with the intention that site owners would put the generated code directly on their site, or that stripe would host the service themselves. After all, you're already trusting them to run the service, might as well trust them to run the form too.

Not that it's terribly hard to build a stripe-compatible form...