Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

5900 online stores found skimming

gwillem.github.io

Post reply on HN
Print view View original

1–10 of 104 posts

Re: 5900 online stores found skimming

#3

Post by mrweasel »

As the article points out, if someone can inject Javascript into your checkout page, you're most likely also having other security issues.

Still, and I'm pretty much being called an idiot every time I point this out: You should NEVER have the user enter credit card information on your site. That is something that is best left to your PSP. If you're Amazon or similar size, fine, I can accept that you most likely have the need resources. Anyone smaller should never interact with credit card information, leave it to Stripe, BrainTree, Paypal, someone trusted, with the resources to handle it.

Also I'm not really surprised to see that it seem to be affecting Magento shops. Similarly to not accepting credit card directly: If you don't have the technical resource, don't run Magento. It's big and complicated, and you need to react fast when there's a problem. Contracting is an option, but expensive and the turn around time is a lot higher, especially if there's a critical error in Magento and everyone need the issue fixed right then and there.

Re: 5900 online stores found skimming

#5

Post by notmything »

mrweasel wrote: post #3

As the article points out, if someone can inject Javascript into your checkout page, you're most likely also having other security issues. Still, and I'm pretty much being called an idiot every time I point this out: You should NEVER have the user enter credit card information on your site. That is something that is best left to your PSP. If you're Amazon or similar size, fine, I can accept that you most likely have…

I work in ecommerce consulting - most of my clients take CC info on their site, the forms on the checkout POST (over SSL) to the PSP who then return a token to the site, all future transactions use the token.

Most people don't want to bounce customers to a third party site for payment, it really hurts conversions.

Re: 5900 online stores found skimming

#6

Post by 4ad »

notmything wrote: post #5
mrweasel wrote: post #3

As the article points out, if someone can inject Javascript into your checkout page, you're most likely also having other security issues. Still, and I'm pretty much being called an idiot every time I point this out: You should NEVER have the user enter credit card information on your site. That is something that is best left to your PSP. If you're Amazon or similar size, fine, I can accept that you most likely have…

I work in ecommerce consulting - most of my clients take CC info on their site, the forms on the checkout POST (over SSL) to the PSP who then return a token to the site, all future transactions use the token. Most people don't want to bounce customers to a third party site for payment, it really hurts conversions.

I certainly hate it when merchants bounce me to a different site. It's most likely I will never complete the transaction and just buy from Amazon instead.

If your site sacrifices user experience, I will hate your site. Simple as that. Amazon understands the convenience factor really well.

I hope Apple Pay (on the web) takes off. While I don't like yet another middle man, and I don't care about its security benefits in the slightest, I appreciate the consistent and convenient interface it provides, so I will use it, if offered the choice.

Re: 5900 online stores found skimming

#8

Post by anondon »

I constantly see various posts regarding credit card skimming and find it curious why 2 factor authentication is not enforced for all transactions. It's a simple solution, having someone's credit card info is not sufficient to make a transaction.

Note: I am not from the USA. The 2FA solution is the default in my country, and I have literally never heard anyone lose money because of skimming.

Re: 5900 online stores found skimming

#9

Post by kalleboo »

anondon wrote: post #8

I constantly see various posts regarding credit card skimming and find it curious why 2 factor authentication is not enforced for all transactions. It's a simple solution, having someone's credit card info is not sufficient to make a transaction. Note: I am not from the USA. The 2FA solution is the default in my country, and I have literally never heard anyone lose money because of skimming.

There's a lot of hate against 3DSecure around here because a lot of banks and stores (seems primarily in the US and U.K.) have extremely poor implementations of it.

Horror stories on here range from having the 3DSecure in an iframe to having horrible "secret question" style inline enrollment

My banks implement it decently - weird third party URLs (albeit with the banks name on the EV certs), but using mobile 2FA apps or hardware card readers for the verification. One of my banks enforces 3DSecure for their debit cards (but not credit cards) since all domestic stores support it.

Re: 5900 online stores found skimming

#10

Post by kalleboo »

notmything wrote: post #5
mrweasel wrote: post #3

As the article points out, if someone can inject Javascript into your checkout page, you're most likely also having other security issues. Still, and I'm pretty much being called an idiot every time I point this out: You should NEVER have the user enter credit card information on your site. That is something that is best left to your PSP. If you're Amazon or similar size, fine, I can accept that you most likely have…

I work in ecommerce consulting - most of my clients take CC info on their site, the forms on the checkout POST (over SSL) to the PSP who then return a token to the site, all future transactions use the token. Most people don't want to bounce customers to a third party site for payment, it really hurts conversions.

> it really hurts conversions

This. We saw about 50% would prefer on-site transactions, 50% would prefer off-site transactions (PayPal or Amazon payments). Remove one of the options and half your customers just disappear.

Post reply on HN