Live data from Hacker News

New version of Stripe Checkout

stripe.com

121–130 of 162 posts

Re: New version of Stripe Checkout

#121
If people are looking for a hosted cart, why not go with a more generic provider instead, like 2Checkout or Fastspring? See: https://www.2checkout.com/digital-commerce/

Benefits: 40+ payment methods (including PayPal), full tax management (including filings), more customization options, etc.

Seems like Stripe is behind the 8 ball with this one. Or what am I missing?

Re: New version of Stripe Checkout

#122

Earlier quoted context omitted.

The advantage of PayPal is that I can make one-time purchase at random vendor whom I have no prior experience with, without having to trust them to protect my Credit Card info.

Isn't this the same benefit you get from stripe? Further being famously bad at developing software anyone would want to use doesn't necessarily mean that someone is incompetent in all aspects but it would decrease my trust in paypal just a little.

Not really, how does the end user know that the credit card number they're entering isn't being stolen by the merchant they're buying from? In theory the merchant should never even get the credit card number if they're integrating with stripe honestly and correctly, but the end user won't know that unless they're inspecting the traffic.

Re: New version of Stripe Checkout

#123

For people impacted by SCA in a few months time (EU) this is really nice. SCA: https://stripe.com/en-US/guides/strong-customer-authenticati... EU e-commerce credit card transactions currently often redirect to the bank providing your card to authenticate before accepting the payment. The UX is very poor. The beneficiary of the check is the bank, but they tell you it is done for your own security. For some reason, fin…

The first time I saw this flow I thought I was getting phished. It really is ridiculous how you get sent to a strange domain name which may or may not have the name of your card issuer in it.

Exactly the point I made about Plaid's login flow-

https://github.com/plaid/link/issues/68#issuecomment-4408942...

For the average Web user, if you don't see a name you trust with an EV cert in friendly green in your address bar, you shouldn't be giving up the keys to your bank account. Plaid and (soon formerly?) Stripe embedding their widgets into the parent page are just training users to get scammed. I'm still beating this drum because it's still a serious problem and nobody seems to care.

Re: New version of Stripe Checkout

#124
post #116

Any support for EU VAT handling coming to this? A lot of work seems to have gone into European support here - odd that VAT handling not part of that.

The EU is not a priority for Stripe, which I think is very unfortunate. They only support a subset of countries. I would have switched from Braintree a long time ago if only Stripe were available in Poland. Braintree works, but is a source of ongoing cost, as it is impossible to do automatic reconciliation. There is no way to connect the (batched) payouts that you get with transactions/invoices. A major problem in th…

(I work at Stripe.)

We are actively working on Poland. I would love to learn more about your business and potentially get you early access. Please contact me directly. My email is felix at stripe com

Re: New version of Stripe Checkout

#126
post #112
post #106

Earlier quoted context omitted.

So we can build a modal version with Elements that supports all features? But Stripe removed the modal option from Checkout because features?

A modal with Elements could support all the features that old modal Checkout supports. It would not be able to do all the things that new non-modal Checkout will be able to do in the near future.

You mean SCA-3DS or?

The Stripe 3DS and SCA page says a modal in combination with Elements is fully supported:

Pre-built modal: The Payment Intents API integrates tightly with Stripe.js and Elements to simplify the authentication process. If your Stripe integration uses handleCardPayment or handleCardAction, Stripe.js automatically handles the authentication process—displaying a modal dialog where the customer can provide the requisite information.

This makes it look like we can build a modal version via Elements which fully supports SCA and 3DS through another modal. All on one page.

Also, the Paymentintent docs say we have to set the viewport to mobile on our page so that the UI of Elements can handle 3DS, this makes it also look like it works on our page through a model without redirects. Otherwise Stripe would set the viewport.

Does Elements fully support 3DS and SCA all on our page through modals or not?

Re: New version of Stripe Checkout

#127

Earlier quoted context omitted.

The first time I saw this flow I thought I was getting phished. It really is ridiculous how you get sent to a strange domain name which may or may not have the name of your card issuer in it.

Exactly the point I made about Plaid's login flow- https://github.com/plaid/link/issues/68#issuecomment-4408942... For the average Web user, if you don't see a name you trust with an EV cert in friendly green in your address bar, you shouldn't be giving up the keys to your bank account. Plaid and (soon formerly?) Stripe embedding their widgets into the parent page are just training users to get scammed. I'm still bea…

EV is not a solution to any problem, much less this. This is a bigger problem with how the web communicates identity, I wouldn't really blame Plaid/Stripe/etc, their alternatives suck.

I think Stripe is a great example for this because in many cases, it's not actually clear where your credit card/etc is going, webpages just silently pass the form fields to Stripe.js.

Re: New version of Stripe Checkout

#128

For people impacted by SCA in a few months time (EU) this is really nice. SCA: https://stripe.com/en-US/guides/strong-customer-authenticati... EU e-commerce credit card transactions currently often redirect to the bank providing your card to authenticate before accepting the payment. The UX is very poor. The beneficiary of the check is the bank, but they tell you it is done for your own security. For some reason, fin…

> The beneficiary of the check is the bank, but they tell you it is done for your own security.

To clarify, this is about a liability shift. By putting customers through payer authentication, liability for fraud shifts to either the merchant or the customer, depending on the flow, rather than the bank. This is why the bank is the beneficiary.

Re: New version of Stripe Checkout

#129
I switched today to the new Checkout and it worked flawless (took me ~1.5 hours).

Let's see how people react to the new checkout. However PayPal is still more common for us (1. classic bankwire, 2. PayPal, 3. Credit card, 4. Sofort/Klarna). Target audience for the ranking is a high order value manifacturing German B2B shop.

Re: New version of Stripe Checkout

#130

Earlier quoted context omitted.

The first time I saw this flow I thought I was getting phished. It really is ridiculous how you get sent to a strange domain name which may or may not have the name of your card issuer in it.

Exactly the point I made about Plaid's login flow- https://github.com/plaid/link/issues/68#issuecomment-4408942... For the average Web user, if you don't see a name you trust with an EV cert in friendly green in your address bar, you shouldn't be giving up the keys to your bank account. Plaid and (soon formerly?) Stripe embedding their widgets into the parent page are just training users to get scammed. I'm still bea…

I've also taken issue with Plaid. [0]

In Plaid's case, the issue is twofold: (a) the chilling effect of "training to get scammed," as you mention; (b) the fact that Plaid's servers log into your bank account on your behalf without clearly disclosing that to the user (unless you have 2FA enabled, in which case they will helpfully instruct you to "disable extra security settings at sign-on"). In fact, it's worse than no disclosure, because Plaid imitates the branding of the login page of your bank.

The solution is obvious, although maybe less than palatable to the Plaid marketing department. Plaid needs to be extremely clear that it is logging into your bank account on your behalf (including detailed statements about security architecture and data retention). They should also stop appropriating the logos and login branding of banks.

In the case that Plaid is not doing this (maybe a few years from now every bank finally has an API, or maybe you use a bank that has one now), then they should use proper third party authorization flow with the bank, where the user explicitly grants privileges from their bank account to Plaid.

Regarding the topic at hand -- Stripe Checkout -- it's a bit disingenuous to equate its flow with Plaid's. The major difference is that Stripe is not logging into your bank account on your behalf without informing you.

[0] https://news.ycombinator.com/item?id=18654880#18655712

Post reply on HN