Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Accepting payments is getting harder

medium.com

Post reply on HN
Print view View original

61–70 of 125 posts

Re: Accepting payments is getting harder

#61

Post by ique »

matthewarkin wrote: post #47
ique wrote: post #34

Earlier quoted context omitted.

With the old Stripe.js, you serve up the form but the Stripe javascript takes over the form and posts directly to Stripe, so your servers never see the data. The new Stripe.js will render an iFrame, (Edit:) through which Stripe will send the data, which again posts to directly to stripe. They basically behave the same way and will look the same way, the only difference is that the iFrame is in it's own Javascript "do…

The new Stripe.js does not render an iframe, the credit card information is still entered on your site so $("#credit-card-number").val() would return the card number. The transmission of the card data happens through the iframe. So the card number gets copied to the iframe, and the iframe makes the post to Stripe.

You are right, editing my comment.

Re: Accepting payments is getting harder

#62

Post by csirac2 »

StavrosK wrote: post #23
csirac2 wrote: post #20

Earlier quoted context omitted.

Woah. Precisely the reason that card networks and issuers have been so lax previously is that they want consumers and issuers to use their damn cards. Being painful to use for merchants and consumers is incompatible with that. Until now losses were small enough... Now, PCI assessment industry is such a profoundly small thing next to the losses and risk carried by issuers - let alone the sheer core business volumes at…

Wouldn't that happen by just making rules that led to people using third-party services, though? Why is it a requirement that you change users' passwords every 90 days (something which I outright don't want to do), or get audited once a year (which is a considerable expense for no actual feedback, other than running an automated tool)?

Yes, we can argue that the content is less than perfect (are there really no permissible controls to get around 90day passwords, such as 2FA?), I'm just taking issue with the assumption that this is a conspiracy designed to line the pockets of QSAs (it's news to me that they provide zero feedback and business value - but then I'm not so close to PCI stuff).

Edit: I'm sure I've read that PCI 3 wasn't written in a vacuum - surely there is some trend in the data that's not visible to us that prompted the 90 day password thing (keyloggers for one, certain POS manufacturers using the same default passcodes on all their products for over 20 years another).

Re: Accepting payments is getting harder

#63

Post by StavrosK »

csirac2 wrote: post #62
StavrosK wrote: post #23

Earlier quoted context omitted.

Wouldn't that happen by just making rules that led to people using third-party services, though? Why is it a requirement that you change users' passwords every 90 days (something which I outright don't want to do), or get audited once a year (which is a considerable expense for no actual feedback, other than running an automated tool)?

Yes, we can argue that the content is less than perfect (are there really no permissible controls to get around 90day passwords, such as 2FA?), I'm just taking issue with the assumption that this is a conspiracy designed to line the pockets of QSAs (it's news to me that they provide zero feedback and business value - but then I'm not so close to PCI stuff). Edit: I'm sure I've read that PCI 3 wasn't written in a vacu…

Maybe I'm wrong, but the few times I've had to fix PCI-scanned sites for compliance, the feedback was just whatever an external automated tool could find, which was almost nothing, and when you fixed the few warnings in the otherwise abysmal codebase, you got the approval.

Re: Accepting payments is getting harder

#64

Post by ukigumo »

Well, I guess it won't hurt if I offer my services for PCI guidance for startups here :-)

One thing to keep in mind is that PCI is a bare-minimum of security "best practices" that aims at validating that a company transacting with payment cards has an understanding of data classification and protection.

Re: Accepting payments is getting harder

#65

Post by matthewarkin »

fragmede wrote: post #58
cm2187 wrote: post #52

We should have moved a long time ago to vendor specific credit card numbers (ecommerce isn't exactly a new activity). Say I get from my bank a token which I provide to this vendor, and the first time the vendor uses it to accept a payment, the token locks in to that vendor, i.e. my bank will not allow any payment with this token to another vendor (i.e. to another bank account). Then it doesn't matter if it's stolen,…

Bank of America has ShopSafe which allows you to generate a temporary credit card number to use with the sketchy online merchant that has the particular gadget I want to buy. Their implementation leaves much to be desired, but it's a step in the right direction.

Last I checked this was also only offered for credit cards, not their debit cards :(

Re: Accepting payments is getting harder

#66

Post by jpatokal »

Every time legacy payment processors ratchet up compliance requirements, cryptocurrencies get another little boost. And while it's easy to forget in the US, where credit cards are handed out in boxes of cereal, getting a credit card is an insuperable hurdle of much of the world's population, eg. the estimated 75% of Indians who work in the informal economy and thus can't prove (or don't have) regular income.

Re: Accepting payments is getting harder

#67

Post by belorn »

Animats wrote: post #18

This is good. People are getting fed up with replacing their credit card every six months because some online retailer had a breach. You can outsource payment processing to Stripe, Paypal, Square, Yahoo Store, etc. There's no reason every web merchant should see credit card numbers. Stripe is in Visa's doghouse right now.[1] Their entry on the Visa Global Registry of Service Providers has turned yellow, with an expir…

There is of course alternative technical solutions to this problem, one being virtual credit card that can be used once per purchase. I would not trust that the outsourced payment processing system never get a breach.

Re: Accepting payments is getting harder

#68

Post by nothrabannosir »

BlackFly wrote: post #53
Animats wrote: post #18

This is good. People are getting fed up with replacing their credit card every six months because some online retailer had a breach. You can outsource payment processing to Stripe, Paypal, Square, Yahoo Store, etc. There's no reason every web merchant should see credit card numbers. Stripe is in Visa's doghouse right now.[1] Their entry on the Visa Global Registry of Service Providers has turned yellow, with an expir…

The real solution to the problem is use of an integrated circuit card, usually through EMV. If a web merchant uses 3D secure or Verified By Visa or SafeKey (from MC, Visa and AmEx respectively), the issuing bank can implement the same level of security in a web transaction that occurs in a card present chip transaction. Proof that the transaction was originated by someone who has control over the card, proof that the…

This solution is already implemented in large parts of the world and good to go! But the incentives are sometimes not right. Ultimately, I want IC payments to be cheaper, as a merchant. I want my incoming IC payments to be in a separate bookkeeping from the non-IC: increase in fees on the latter, I'd like to keep my rates for the former.

Ultimately, I can then pass these savings on to the customers.

But as long as there is no incentive to ask for IC, why would I? It's just an annoyance.

Re: Accepting payments is getting harder

#69

Post by kalleboo »

cm2187 wrote: post #52

We should have moved a long time ago to vendor specific credit card numbers (ecommerce isn't exactly a new activity). Say I get from my bank a token which I provide to this vendor, and the first time the vendor uses it to accept a payment, the token locks in to that vendor, i.e. my bank will not allow any payment with this token to another vendor (i.e. to another bank account). Then it doesn't matter if it's stolen,…

I like the PayPal model (vendor gets nothing), I just wish it could be federated...

Re: Accepting payments is getting harder

#70

Post by sageabilly »

This move makes sense if you look at PCI's board of advisors[1]- It's a bunch of bank VPs plus the head of security for both First Data and Pay Pal. The people who run PCI compliance are the ones that stand to lose if PCI compliance becomes moot, so they are doing all they can to make it seem like it's the be-all end-all of internet security and that you'd be a fool to trust an online merchant that wasn't PCI compliant.

Interesting point about making vendor specific security tokens for internet transactions in an earlier comment. That would quite obviously help tremendously in the case of a breach, however that would put the onus on banks to be responsible for security instead of on merchants, and again the bank representatives on the BOA at PCI aren't going to go for that.

[1] https://www.pcisecuritystandards.org/organization_info/board...

Post reply on HN