11–20 of 32 posts
Earlier quoted context omitted.
I remember seeing these same concerns with the Stripe button. Edit: found the old discussion link: https://news.ycombinator.com/item?id=5079702&mobify=0
This phishing concern is part of why we decided to use one-time SMS tokens with Checkout -- there's no password to steal.
Earlier quoted context omitted.
Google Wallet does the same thing as Stripe checkout with the overlay: https://www.humblebundle.com/ Is the URL inspection the best way to make sure you're going to the right site? I know that for us deeply technical folks that's the case, but for someone less technical, they wouldn't know the difference between one URL redirect vs. another.
Not quite. If you're not logged in, Google Wallet will open a popup (as opposed to a JS modal overlay), clearly identified as " https://accounts.google.com" , prompting you to enter your username and password. The username and password are never entered under the same URL bar as the 3rd party site. If Braintree's checkout process opened a popup window, with a clear URL bar, into which the user entered their username/…
Earlier quoted context omitted.
Google Wallet does the same thing as Stripe checkout with the overlay: https://www.humblebundle.com/ Is the URL inspection the best way to make sure you're going to the right site? I know that for us deeply technical folks that's the case, but for someone less technical, they wouldn't know the difference between one URL redirect vs. another.
Not quite. If you're not logged in, Google Wallet will open a popup (as opposed to a JS modal overlay), clearly identified as " https://accounts.google.com" , prompting you to enter your username and password. The username and password are never entered under the same URL bar as the 3rd party site. If Braintree's checkout process opened a popup window, with a clear URL bar, into which the user entered their username/…
Earlier quoted context omitted.
Not quite. If you're not logged in, Google Wallet will open a popup (as opposed to a JS modal overlay), clearly identified as " https://accounts.google.com" , prompting you to enter your username and password. The username and password are never entered under the same URL bar as the 3rd party site. If Braintree's checkout process opened a popup window, with a clear URL bar, into which the user entered their username/…
This is Pedro, one of the developers at Braintree who worked on this product. Security is our top priority which is why we will show a pop-up window hosted on a PayPal domain in the environments that support it. We are incrementally rolling this feature out. Here's more info about this particular issue: https://developers.braintreepayments.com/javascript+ruby/sdk...
I guess I'm not up on the limitations of mobile browsers, but if they really make it so hard to expose the URL, it would seem to re-open a huge array of phishing attacks (and, once these are heavily exploited, mobile browsers will probably get better about exposing URLs.)
I skimmed but does anyone know why they called it V.zero?
Earlier quoted context omitted.
This is Pedro, one of the developers at Braintree who worked on this product. Security is our top priority which is why we will show a pop-up window hosted on a PayPal domain in the environments that support it. We are incrementally rolling this feature out. Here's more info about this particular issue: https://developers.braintreepayments.com/javascript+ruby/sdk...
Interesting. I understand that popups might not be supported in certain environments, but it would seem the preferable flow in that case would be to forward to Paypal, authorize, then forward back. I just don't see any way to protect a lightbox from phishing, even if that's only on a subset of devices. I guess I'm not up on the limitations of mobile browsers, but if they really make it so hard to expose the URL, it w…
Will this be able to save credit cards on the device so the user doesn't need to re-enter their credit card every single time they need to make a purchase?
Does this work for marketplace payments?