Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Card – An interactive CSS3 credit card form

jessepollak.github.io

Post reply on HN
Print view View original

91–100 of 117 posts

Re: Show HN: Card – An interactive CSS3 credit card form

#91

Post by gameguy43 »

iLoch wrote: post #69

This is great! There's also Skeuocard ( http://kenkeiter.com/skeuocard/ ) which offers a bit more of a skeuomorphic design. I think I favour the form as part of the card, however this may be confusing/inaccessible to some people - nice work on the library!

I like skeuocard's experience a lot. But it's not responsive, so it was a no-go for me. Ended up rolling my own.

One great optimization skeuocard has is it only asks for the cc# at first, then the other fields appear as you type it in. So the form is less daunting at first.

Re: Show HN: Card – An interactive CSS3 credit card form

#93

Post by christudor »

For me the whole thing took too long to load. I didn't even see the card until I had filled in most of the data in the fields (and I was thinking, 'What's so different about this?'). Then the card loaded and all the data I had put in already was automatically deleted and I had to do it all again. If I was buying something on a whim, this might just be enough for me to think 'Forget it'.

More generally, while I do think that entering card details is a bit of a ball-ache, I don't think the solution is having a picture of the card on screen...

Re: Show HN: Card – An interactive CSS3 credit card form

#94

Post by the_ancient »

jacquesm wrote: post #89
the_ancient wrote: post #87

Earlier quoted context omitted.

Overreact much? Most people that will be taking credit cards directly via a form like this will have merchant account and be authorized to use the credit card logos. If they are using a service like PayPal they are mostly redirecting to their service providers site for processing not taking the card info directly. The usage of the network logos are not as strict as you are implying here, even if you use paypal you ca…

> Most people that will be taking credit cards directly via a form like this will have merchant account and be authorized to use the credit card logos. Using logos in combination with a credit card capture form comes with a different set of rules (and a different contract!) than just being allowed to use some third party processor that does all the work for you. If you want to capture the cards yourself instead of ou…

I am fully aware of PCI, I used to develop billing systems, Utility Billing Systems to be exact a heavily regulated industry that has even more rules than normal ecommerce. Further anyone that collects credit card data must be PCI Compliant, period. There are 4 Levels of PCI Compliance and depending on what your doing with the Credit Card data and how many transactions you process determine where you fall, many small merchants are only Level 4

Edit:

I Just looked at your list of "Payment Facilitators". If you use one of those processors YOU DO NOT HAVE A MERCHANT ACCOUNT. I think that is where the communications break down is happening, a merchant account is a specific thing, Using 2 Checkout, or Stripe (which is the service this seems targeted at) does not mean you have a "merchant account". None of these services claim to give you a merchant account.

Further I can find thing to support your claim that using this form with Stripe or another "Payment Facilitators" would be in violation of any agreements. However when I replied I was not talking about people that use these "Payment Facilitators", a person with merchant account, a person that uses a full gateway like Authorize.net which a huge number of merchants do should not be at all concerned with using this form

None of the links you posted have supported your claim, nor can I find any supporting documentation to back your claims. You do not need to post your mythical very restrictive merchant agreement, you should just post the text about that your talking about. Or find me any company most of which have their standard agreements and terms online, that says anything about this. I have look at most of the major payment gateways, 3rd party processors, and various others people, plus I have contacted some people I know that still work in development of payment systems (I have been out of that game for about 5 years now) and none of them have any clue what your talking about.

Re: Show HN: Card – An interactive CSS3 credit card form

#95

Post by spicerguy »

dclowd9901 wrote: post #67

Looks great. Few notes: 1) On the already crowded payment form, I don't want to devote a hell of a lot of space to something that is otherwise inconsequential (a picture of a credit card) 2) Is it a great idea to broadcast someone's card numbers so clearly? The graphic is so obviously a credit card, it would be easy for any onlooker to spot and steal. Really, this seems like aesthetics for aesthetics' sake, which I t…

> 2) Is it a great idea to broadcast someone's card numbers so clearly? The graphic is so obviously a credit card, it would be easy for any onlooker to spot and steal.

yes - anything that signposts card data clearly to an onlooker is problematic, but any malicious shoulder surfer will probably be able to spot a payment page a mile off in any case. This might however, have a small possibility of encouraging opportunistic theft.

I think the bigger threat to this probably comes from the networks (MC, VISA, AMEX etc) who get VERY possessive about mock-ups / card image facsimiles that use their logos. The brand logo protection that they enforce is pretty strict and I would imagine this approach would not be welcomed. I'd like to be wrong, but my experience with the networks makes me pessimistic.

Re: Show HN: Card – An interactive CSS3 credit card form

#96

Post by jacquesm »

the_ancient wrote: post #94
jacquesm wrote: post #89

Earlier quoted context omitted.

> Most people that will be taking credit cards directly via a form like this will have merchant account and be authorized to use the credit card logos. Using logos in combination with a credit card capture form comes with a different set of rules (and a different contract!) than just being allowed to use some third party processor that does all the work for you. If you want to capture the cards yourself instead of ou…

I am fully aware of PCI, I used to develop billing systems, Utility Billing Systems to be exact a heavily regulated industry that has even more rules than normal ecommerce. Further anyone that collects credit card data must be PCI Compliant, period. There are 4 Levels of PCI Compliance and depending on what your doing with the Credit Card data and how many transactions you process determine where you fall, many small…

Well, some people that I contacted verify my story and I worked on payment systems as recently as 6 months ago. But what statements like that do to bolster a position is not clear to me.

I'm not sure what you're trying to achieve here, some kind of anecdotal proof that I'm wrong?

You're completely missing the point of the sub-merchant situation, one where you have a contract with both the card companies (one for VISA, one for MC etc) and a contract with an IPSP. This is the situation I'm talking about and it is one that is quite common for mid-sized merchants, just a bit too large for the various parties listed in those links and too small to be dealing with the overhead of becoming PCI compliant.

Whether you and your friends are aware of that or not is frankly immaterial, I happen to be in that precise situation so I think I know what I'm talking about, whether you believe me or not is your problem.

I'm under no obligation to post any text here whatsoever, this is an internet forum, not some kind of court proceedings and the claim I'm making is not so outrageous that it requires extraordinary proof to satisfy you.

Re: Show HN: Card – An interactive CSS3 credit card form

#97

Post by [deleted] »

chandrew wrote: post #52
dshankar wrote: post #35

Looks gorgeous. I can't help but wonder if people unfamiliar with technology and ecommerce would be deterred by such a form? It might give some users the impression that the website is "copying" the credit card. It would be interested to test the opinions of non-tech savvy users.

Same thoughts!

[deleted]

Re: Show HN: Card – An interactive CSS3 credit card form

#98

Post by [deleted] »

shogun21 wrote: post #75
benaiah wrote: post #58

Earlier quoted context omitted.

Well, of course untrusted code dealing with CC info is insecure. That's why this is open source, and you host it yourself. It's just a library. Whose source you can see. Whose source you can compile. With a third-party compiler. You'd say you'd trust it if it was from Google - in this case, if you use it, it's coming from you , on your server, under your control. I'd trust this far more than a Google-hosted closed-so…

Because it's open source, we can figure out exactly what's going on. OP brings up the point from the users' perspective and they might not trust an interface that looks this flashy.

[deleted]

Re: Show HN: Card – An interactive CSS3 credit card form

#99

Post by [deleted] »

benaiah wrote: post #58
logicallee wrote: post #44

Earlier quoted context omitted.

I don't know about people unfamiliar with technology, but as someone very familiar with technology, my first thought is that this could easily be a vector for copying the card information! All you need is to load some encoded image off of a third server to leak card info via a side channel, if your code is underhanded. I would trust "one line of code" if it's a solution from Google or something, but for something thi…

Well, of course untrusted code dealing with CC info is insecure. That's why this is open source, and you host it yourself. It's just a library. Whose source you can see. Whose source you can compile. With a third-party compiler. You'd say you'd trust it if it was from Google - in this case, if you use it, it's coming from you , on your server, under your control. I'd trust this far more than a Google-hosted closed-so…

[deleted]

Re: Show HN: Card – An interactive CSS3 credit card form

#100

Post by kethinov »

spicerguy wrote: post #95
dclowd9901 wrote: post #67

Looks great. Few notes: 1) On the already crowded payment form, I don't want to devote a hell of a lot of space to something that is otherwise inconsequential (a picture of a credit card) 2) Is it a great idea to broadcast someone's card numbers so clearly? The graphic is so obviously a credit card, it would be easy for any onlooker to spot and steal. Really, this seems like aesthetics for aesthetics' sake, which I t…

> 2) Is it a great idea to broadcast someone's card numbers so clearly? The graphic is so obviously a credit card, it would be easy for any onlooker to spot and steal. yes - anything that signposts card data clearly to an onlooker is problematic, but any malicious shoulder surfer will probably be able to spot a payment page a mile off in any case. This might however, have a small possibility of encouraging opportunis…

I'm less concerned with the reuse of their logos and more concerned with the fact that their logos are implemented in HTML/CSS rather than as images, which means there will be subtle differences.

Basically those aren't their logos. They're slightly inaccurate imitations. Most big brands will be upset if even a few pixels are off when their logo is displayed.

Post reply on HN