Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Payments Startup Stripe (YC S10) Joins the Billion Dollar Club

online.wsj.com

Post reply on HN
Print view View original

81–90 of 131 posts

Re: Payments Startup Stripe (YC S10) Joins the Billion Dollar Club

#81

Post by cschmidt »

Congratulations to the Stripe team. Strips is one of those excellent companies that make the tech world a better place.

I actually spent the day working on adding Stripe integration to a Django application for my startup. Since there seem to be a number of Stripe people on this thread, I thought I might give some feedback.

It was fairly straightforward to add a custom credit card form, but not as easy as I had expected. You've made a really nice form with Checkout, but that isn't flexible enough for many users. You leave a fair bit of work to your customers if they use the raw Stripe.js library. You mention your open source jquery library for doing client side validation [1], but don't provide any good examples. In particular, the neat trick in Checkout where you show the logo of the type of credit card being used isn't documented anywhere. This blog post [2] is a crucial piece of information. Your Django examples seems a little out of date, as you've been using Flask for your python examples.

In short, I spent a day pulling things together, and got a form that has many of the nice features of Checkout. That's cool. However, you should really make it dead simple for your customers, with good examples that give ultra-slick validation and results.

Thanks for listening, and continue being great.

[1] https://github.com/stripe/jquery.payment

[2] http://yoast.com/checkout-field-validation/

Re: Payments Startup Stripe (YC S10) Joins the Billion Dollar Club

#82

Post by treenyc »

pc wrote: post #5

Stripe cofounder here. As this news breaks, I want to say thanks to the HN community. Stripe is in large part the result of the feedback and advice we've received here since we launched on HN back in Sept 2011 -- https://news.ycombinator.com/item?id=3053883 .

I started building a SaaS for the legal industry around 2004. It was very small targeted at specific industry. Back then it was very hard to get everyone on board to use Credit Card. I ended up automating everything (including the monthly billing sent directly the user's inbox), but because of difficulty of payment gateway processing (getting a merchant account, parsing the authorize gateway code)

And since I was a one man shop, I just had my users to send me checks at end of the month. I was not the best organized person back then. So let's just say there were quite few uncashed checks. Really wish Stripe was around them.

Re: Payments Startup Stripe (YC S10) Joins the Billion Dollar Club

#83

Post by eieio »

glaugh wrote: post #26
eieio wrote: post #18

Is there a way to read this article without logging in?

They let clickthroughs (clicksthrough?) from Google read the whole thing. https://www.google.com/search?q=Payments+Startup+Stripe+Join...

I tried googling the name of the article earlier and it didn't work, but apparently I screwed something up. Thanks for the link.

And I like clicksthrough :)

Re: Payments Startup Stripe (YC S10) Joins the Billion Dollar Club

#84

Post by Silhouette »

patcheudor wrote: post #77
slexaxton wrote: post #43

Earlier quoted context omitted.

(Stripe Developer) - tl;dr -- This claims that Stripe.js runs on the merchant's server environment, causing the server to be subject to PCI DSS. In reality, Stripe.js is served from Stripe's servers, and runs only in the browser, and this has always been the case.

In order to get Stripe.js to execute within the same origin of the merchant environment the merchant must include code like this: within their HTTP response. This can be modified by a criminal on the merchant server to go to if the merchant has not implemented proper controls as outlined in the PCI DSS. The same can happen if they implement weak crypto. At the end of the day the merchant is responsible for this PCI r…

This can be modified by a criminal on the merchant server to go to

And then the merchant won't be following one of Stripe's two basic rules for staying PCI DSS compliant any more, will they?

That aside, of course you want to keep your server secure. But if you can't, as a matter of practical security and protecting cardholders in the real world, how would it be any better to have your site intended to transfer entirely to a payment service on their own domain rather than just loading JS from that domain? An attacker who has compromised the security of the files on a merchant's server can change an that should transfer to the payment service so it goes to a hostile site just as easily as they can change a that should load JS from a payment service so it loads JS from a hostile site.

Re: Payments Startup Stripe (YC S10) Joins the Billion Dollar Club

#85

Post by patcheudor »

pbreit wrote: post #78
patcheudor wrote: post #49

Earlier quoted context omitted.

Because the PCI guidance isn't factual enough? An essay could be written about the problems with broad statements like merchants only needing to worry about the inclusion of Stripe.JS and the use of HTTPS to be PCI compliant. Luckily those already exist. This one covers it pretty well: http://pciguru.wordpress.com/2013/06/30/developers-beware-st...

I read that and am still far from clear on whether or not your accusations have merit.

I think you just hit on a major issue that merchants face when it comes to the PCI DSS. Many merchants have been wrestling with the scope of PCI DSS compliance for years. They are looking for easy solutions where unfortunately there are very few. The PCI council has done a very respectable job of creating compliance guides and standards documentation. However, when it comes to implementation merchants struggle with scope. If a merchant server as an example responds with a reference to the stripe.js & that code is then executed within the browser context of the merchant domain, is that merchant server in scope for that component? I believe it is and every QSA (PCI qualified security assessor) I've had this same conversation with has come to that exact same conclusion. If Stripe consults with their QSA and they come to a different conclusion, then I would hope Stripe would share that publicly with the community. That would certainly be a ground breaking event for those of us who deal with PCI DSS on a daily basis.

In terms of accusation, my goal here is to ensure that Stripe.com and others who are working in this space are being as clear as possible with their communication, that's it. Stripe is going to address statements like the one I pointed out on their site & hopefully as an industry we can get to a point where everyone is a bit more clear on what falls in and out of PCI DSS scope.

Re: Payments Startup Stripe (YC S10) Joins the Billion Dollar Club

#86

Post by dragonwriter »

kamaal wrote: post #66
kulkarnic wrote: post #56

This is both amazing and scary. The amazing part is obvious. The scary part is we now have companies that are worth a billion dollars that are unlisted and have no public scrutiny. Either a billion is not a very large number to the American people today, or we believe that public scrutiny is unnecessary for large companies today. I don't think at all that Stripe is one of them, but wouldn't a billion dollar company b…

I'm not sure what you mean by 'public scrutiny'. Surely any common person on the street has absolutely no influence over Google or Microsoft wishes to do. And going public hardly has any influence at all. Beyond all Companies/Organizations are not Governments, they don't collect taxes and they are not voted into power. So they are not answerable to anyone. These are individual(s) who are investing their own time, mon…

> Beyond all Companies/Organizations are not Governments

All juridical entities other than individual persons -- and this definitely includes all corporations -- are creations of government through which special privileges are given to particular individuals on the theory that by doing so some common good will be served.

Re: Payments Startup Stripe (YC S10) Joins the Billion Dollar Club

#87

Post by raganwald »

john2244 wrote: post #29

Stripe is one problem which is solved really really well. Behind the pretty API there is serious amount of work with bureaucracy and traditional systems. Kudos to a job well done.

"Where there's muck, there's brass"--Paul Graham, quoting some timeless business wisdom.

Re: Payments Startup Stripe (YC S10) Joins the Billion Dollar Club

#88

Post by slexaxton »

patcheudor wrote: post #70
ricardobeat wrote: post #61

Earlier quoted context omitted.

That article is wrong on the technical implications, like "It may be their code, but it is executing on your server" (cc data is sent directly to Stripe's servers, never touching your own).

That was maybe not quite the right language, but is easily salvageable. What the author was trying to convey is that the Stripe.js code is instantiated within the user browser by an HTTP response from the server infrastructure owned by the merchant. The actual credit-card form is delivered by the merchants server & therefore they own all the PCI DSS related controls surrounding ensuring that the payment form code del…

[Stripe Developer] [edited for clarification]

I appreciate your interest in the security of Stripe, I think we definitely share the same goals here (making everything as secure as possible). However, I think there's some misunderstanding in some posts (and in the blog post):

> [...] the Stripe.js code is instantiated within the user browser by an HTTP response from the server infrastructure owned by the merchant When Stripe.js is included within the user's browser by a (mandated https, not http) request, it comes directly from Stripe's servers, not from "the server infrastructure owned by the merchant."

Stripe.js isn't served from the merchant. It comes directly from Stripe. Stripe.js helps keep payment card data away from a merchants own servers.

Keeping card data away from someone's machines doesn't mean that they don't need to comply with the Payment Card Industry Data Security Standards, but it does make things quite a bit simpler.

In most cases it means that they're eligible for one of the light-weight self-assessment questionnaires.

PCI compliance, of course, shouldn't be where people stop thinking about security though. You're absolutely right that if the pointer on the merchant's site is changed to a malicious site, that's where the payment data will go. The merchant needs to keep that pointer safe in the same way that if you're redirecting to a hosted payment form or elsewhere, you need to make sure that isn't tampered with either. (A hosted form has the advantage that at least a customer can view the SSL cert but if they don't recognize the domain (or if the domain is obscure anyway), that's not much good.)

Being compliant with the PCI standards is important but it doesn't cover all of the very, very important points of web security.

We do take security very seriously, and if you happen to find a valid security issue with our service, we pay bounties[1] for properly disclosed vulnerabilities.

If you have any other questions, or would like to wax poetic about security or PCI please don't hesitate to send the security team an email at security@stripe.com or to email me personally at alex@stripe.com.

[1] https://stripe.com/help/security#rewards

Re: Payments Startup Stripe (YC S10) Joins the Billion Dollar Club

#90

Post by codex »

I've always thought of Stripe as a "faster horse" in the world of payments. I expect Google, Apple, or Square will find some way to disrupt credit cards completely and move consumers over to a new method of payment for most transactions. PayPal would also like to do that, but I'm not sure they have it in them. And Bitcoin may well upend them all.
Post reply on HN