Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Payments Startup Stripe (YC S10) Joins the Billion Dollar Club

online.wsj.com

Post reply on HN
Print view View original

91–100 of 131 posts

Re: Payments Startup Stripe (YC S10) Joins the Billion Dollar Club

#91

Post by steven2012 »

slexaxton wrote: post #88
patcheudor wrote: post #70

Earlier quoted context omitted.

That was maybe not quite the right language, but is easily salvageable. What the author was trying to convey is that the Stripe.js code is instantiated within the user browser by an HTTP response from the server infrastructure owned by the merchant. The actual credit-card form is delivered by the merchants server & therefore they own all the PCI DSS related controls surrounding ensuring that the payment form code del…

[Stripe Developer] [edited for clarification] I appreciate your interest in the security of Stripe, I think we definitely share the same goals here (making everything as secure as possible). However, I think there's some misunderstanding in some posts (and in the blog post): > [...] the Stripe.js code is instantiated within the user browser by an HTTP response from the server infrastructure owned by the merchant When…

My understanding by reading patcheudor's responses is that the issue isn't with Stripe's PCI compliance, but rather the fact that merchants that use Stripe's API need to be fully PCI compliant. According to him, using Stripe's API doesn't obviate the merchant's need to be fully PCI compliant, unless they do something like open up another window where the URL clearly shows that they are inputting a form from Stripe's own servers. Otherwise, the merchant needs to conform to full PCI compliance.

Re: Payments Startup Stripe (YC S10) Joins the Billion Dollar Club

#92

Post by strumptrumpet »

slexaxton wrote: post #88
patcheudor wrote: post #70

Earlier quoted context omitted.

That was maybe not quite the right language, but is easily salvageable. What the author was trying to convey is that the Stripe.js code is instantiated within the user browser by an HTTP response from the server infrastructure owned by the merchant. The actual credit-card form is delivered by the merchants server & therefore they own all the PCI DSS related controls surrounding ensuring that the payment form code del…

[Stripe Developer] [edited for clarification] I appreciate your interest in the security of Stripe, I think we definitely share the same goals here (making everything as secure as possible). However, I think there's some misunderstanding in some posts (and in the blog post): > [...] the Stripe.js code is instantiated within the user browser by an HTTP response from the server infrastructure owned by the merchant When…

You're playing semantic shell games here. The user has no reasonable way of knowing that stripe.js came from stripe, and as such, there are no technical OR human controls that enforce that behavior.

In short, the fact that stripe.js is delivered from stripe DOES NOT MATTER, because the user CAN NOT reasonably validate this behavior.

I know you're not dumb over at Stripe; I have a hard time believing that you're not willfully lying. After all, "disrupting" onerous industry security standards is to your competitive advantage.

Re: Payments Startup Stripe (YC S10) Joins the Billion Dollar Club

#94

Post by [deleted] »

patcheudor wrote: post #12
pc wrote: post #5

Stripe cofounder here. As this news breaks, I want to say thanks to the HN community. Stripe is in large part the result of the feedback and advice we've received here since we launched on HN back in Sept 2011 -- https://news.ycombinator.com/item?id=3053883 .

Now if Stripe could practice truth in advertising that would be great. SpecificallY: "Anyone accepting credit card payments must be PCI compliant. Stripe makes it easy to do so: Serve your payment page over SSL, i.e., the page's web address should begin with “https”, not “http”. Use Stripe.js or Checkout to accept payment information and transmit it directly to Stripe's servers. And you'll be PCI compliant!" https://…

[deleted]

Re: Payments Startup Stripe (YC S10) Joins the Billion Dollar Club

#95

Post by slowdown »

When is Stripe coming to India? An estimate would be really nice! The only way Indian startups can get to use Stripe right now is by setting up an LLC/LLP in US/UK and accepting payments through the LLC.

The problems with this approach are:

1) High initial cost of setting up the LLC.

2) Lawyer consulting fees and/or CPA fees.

3) Separate taxes for the LLC.

4) The same income is taxed in the country of the LLC AND India.

India is one country that needs Stripe very badly right now. The payment gateways here have the shittiest/unreliable APIs you could imagine of. One of them (CCAvenue) even got hacked and it was found that passwords were being stored in plaintext. (!)

However, the transaction volume is pretty much as high as any other country. Would love to get an idea of when Stripe would become available here..

Re: Payments Startup Stripe (YC S10) Joins the Billion Dollar Club

#96

Post by rgbrenner »

steven2012 wrote: post #91
slexaxton wrote: post #88

Earlier quoted context omitted.

[Stripe Developer] [edited for clarification] I appreciate your interest in the security of Stripe, I think we definitely share the same goals here (making everything as secure as possible). However, I think there's some misunderstanding in some posts (and in the blog post): > [...] the Stripe.js code is instantiated within the user browser by an HTTP response from the server infrastructure owned by the merchant When…

My understanding by reading patcheudor's responses is that the issue isn't with Stripe's PCI compliance, but rather the fact that merchants that use Stripe's API need to be fully PCI compliant. According to him, using Stripe's API doesn't obviate the merchant's need to be fully PCI compliant, unless they do something like open up another window where the URL clearly shows that they are inputting a form from Stripe's…

This is my reading of his comment too.. more specifically, that since the page comes from the merchants server, the page could be modified by an attacker to alter the form to (for example) submit credit card details to another server instead of Stripe's.

I think he has a point here. Certainly if the merchants web site is compromised, Stripe's PCI compliance won't prevent or detect the loss of credit card data (since it never reached the point where Stripe could protect it).

Re: Payments Startup Stripe (YC S10) Joins the Billion Dollar Club

#97

Post by patcheudor »

slexaxton wrote: post #88
patcheudor wrote: post #70

Earlier quoted context omitted.

That was maybe not quite the right language, but is easily salvageable. What the author was trying to convey is that the Stripe.js code is instantiated within the user browser by an HTTP response from the server infrastructure owned by the merchant. The actual credit-card form is delivered by the merchants server & therefore they own all the PCI DSS related controls surrounding ensuring that the payment form code del…

[Stripe Developer] [edited for clarification] I appreciate your interest in the security of Stripe, I think we definitely share the same goals here (making everything as secure as possible). However, I think there's some misunderstanding in some posts (and in the blog post): > [...] the Stripe.js code is instantiated within the user browser by an HTTP response from the server infrastructure owned by the merchant When…

Alex, thank you for your response. I don't think my original observations about the wording of a support doc falls into a vulnerability disclosure. That doc has since been updated with enhanced guidance which addresses my original concern. As I think we all understand, the merchant must be responsible for ensuring the integrity and security of the HTTP response containing the reference to Stripe.js. After that they are absolved of the requirements surrounding the transmission, processing, and storage of the card data. As the PCI DSS states, they are ultimately responsible for their PCI compliance as the merchant.

Re: Payments Startup Stripe (YC S10) Joins the Billion Dollar Club

#98

Post by dmix »

pc wrote: post #5

Stripe cofounder here. As this news breaks, I want to say thanks to the HN community. Stripe is in large part the result of the feedback and advice we've received here since we launched on HN back in Sept 2011 -- https://news.ycombinator.com/item?id=3053883 .

One of the best parts of that 2011 thread is the number of people asking for Canadian support, then how quickly Stripe actually ended up supporting Canada (within 1 year roughly).

We desperately needed Stripe and you guys delivered so quickly. Much appreciated.

Re: Payments Startup Stripe (YC S10) Joins the Billion Dollar Club

#99

Post by patcheudor »

pc wrote: post #27
pc wrote: post #16

Earlier quoted context omitted.

Hm, it looks like that support forum answer needs to be updated -- we actually support filling out PCI SAQs right from our dashboard (and automatically ask users to do so). We'll go update it. Also, if you'd like to drop me an email at patrick@stripe.com, would be happy to chat about PCI more.

(Updated.)

Confirmed.

Re: Payments Startup Stripe (YC S10) Joins the Billion Dollar Club

#100

Post by sumedh »

slowdown wrote: post #95

When is Stripe coming to India? An estimate would be really nice! The only way Indian startups can get to use Stripe right now is by setting up an LLC/LLP in US/UK and accepting payments through the LLC. The problems with this approach are: 1) High initial cost of setting up the LLC. 2) Lawyer consulting fees and/or CPA fees. 3) Separate taxes for the LLC. 4) The same income is taxed in the country of the LLC AND Ind…

Check out Payzippy.
Post reply on HN