Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Payment iframe - the easiest way to insert Stripe into your website

paymentiframe.com

Post reply on HN
Print view View original

31–40 of 84 posts

Re: Payment iframe - the easiest way to insert Stripe into your website

#31

Post by cperciva »

mrgreenfur wrote: post #30

This is a lovely form. Ideally, Stripe would offer something like this as a way to quickly generate a nice cc entry form with the intention that site owners would put the generated code directly on their site, or that stripe would host the service themselves. After all, you're already trusting them to run the service, might as well trust them to run the form too. Not that it's terribly hard to build a stripe-compatib…

site owners would put the generated code directly on their site

That would defeat the protection which the Same Origin policy gives you (since the iframe would have the same origin as the rest of your site).

or that stripe would host the service themselves

Yes, that would be much better.

Re: Payment iframe - the easiest way to insert Stripe into your website

#32

Post by Zr40 »

suweekly wrote: post #10

Or use authorize.net's iframe module and save a ton of $ on Stripe's ripoff fees.

http://www.authorize.net/files/cybersource_pricing.pdf

Ignoring all those extra fees and charges unrelated to a single payment, Authorize.net charges 2.19% + $0.27 in the best case (qualified domestic Visa). In the worst case (non-qualified international MasterCard), they charge 4.49% + $0.2685.

Even only considering the best case, Stripe's 2.9% + $0.30 doesn't seem 'ripoff' to me.

Re: Payment iframe - the easiest way to insert Stripe into your website

#33

Post by suweekly »

Zr40 wrote: post #32
suweekly wrote: post #10

Or use authorize.net's iframe module and save a ton of $ on Stripe's ripoff fees.

http://www.authorize.net/files/cybersource_pricing.pdf Ignoring all those extra fees and charges unrelated to a single payment, Authorize.net charges 2.19% + $0.27 in the best case (qualified domestic Visa). In the worst case (non-qualified international MasterCard), they charge 4.49% + $0.2685. Even only considering the best case, Stripe's 2.9% + $0.30 doesn't seem 'ripoff' to me.

Get the merch acct through Chase, gateway through auth.net - BIG SAVINGS!

Re: Payment iframe - the easiest way to insert Stripe into your website

#34

Post by bryanlarsen »

bentlegen wrote: post #16

Please don't use this. There is nothing stopping paymentiframe.com from taking your customer's credit card numbers.

By using this, you're saying that you trust cperciva more than you trust Stripe. I'm confident that neither are going to try and deliberately steal your credit card numbers. But furthermore, you are saying that cperciva is going to protect paymentiframe.com from hacks better than stripe is going to protect theirs.

Myself, I'd place a lot of trust on cperciva, the former FreeBSD security officer, a guy who has written papers on security flaws in Pentium 4 processors. (http://www.daemonology.net/hyperthreading-considered-harmful...)

[edit] paymentiframe.com's FAQ now includes this:

Why should I trust you with my credit card entry form?

You probably shouldn't. This is more of a proof of concept — but you might also want to use the CGI script to generate an iframe which you download (along with the bits it links to) and serve up as a static file from a server you run (but make sure you get a separate domain name for it).

Re: Payment iframe - the easiest way to insert Stripe into your website

#35

Post by tptacek »

bentlegen wrote: post #16

Please don't use this. There is nothing stopping paymentiframe.com from taking your customer's credit card numbers.

Do you use Typekit? Google Analytics? Mixpanel? Olark? Do those services get used anywhere in the path your users might take from your front page to the page in your app where you take credit cards? Then all those services can take your customer's credit cards too.

I frankly trust Colin Percival a lot more than I trust Olark. And I like Olark.

Your point is something Colin should address in his FAQ, and so it was good of you to make it, but it's also trivially knocked down.

Re: Payment iframe - the easiest way to insert Stripe into your website

#36

Post by tptacek »

bentlegen wrote: post #29
DASD wrote: post #25

Earlier quoted context omitted.

Ben, Are you going to be addressing this in your book, Third Party Javascript? Would love to hear your recommendations for how to handle payment processing such as this.

The book describes techniques that Stripe could use in developing their own iframed credit card form. I'd only trust a solution from them directly.

That doesn't make any sense, because the whole point of PAYMENTIFRAME.COM is that you don't trust Stripe.

Colin implemented this because besides credit card numbers, he was unwilling to give Stripe control over his website. Colin's users trust him with things that are much more sensitive than credit card numbers.

Re: Payment iframe - the easiest way to insert Stripe into your website

#37

Post by staunch »

If I was Stripe I'd be politely asking you to take this down. It's using their trademark (presumably) without permission and encouraging their users to do something very inadvisable.

Offering to host this seems like a really bad idea.

I know you're well meaning and trustworthy, but this shouldn't be run by a third party. For long term reliability reasons as much as security.

Re: Payment iframe - the easiest way to insert Stripe into your website

#38

Post by tptacek »

JSadowski wrote: post #8
pilif wrote: post #6

Earlier quoted context omitted.

By including their JS, you give them full access to all of the contents of your payment page and depending on how you have configured your session cookie or depending on the browser, full access to the users session. Now in general, you can probably trust them, but what if they are compromised? By using an iframe you make sure that they do not get access to any information on your page - much less the users session c…

And you can accomplish the same thing by using an iframe that you have full control over. Instead, if you use this service, you're trusting another 3rd party site to be available and to not be compromised.

That is true, but the point is that the only thing that is going to be compromised is the data that would be going to Stripe.

I know it is shocking to many of you to hear this, but the data Stripe collects is not really the most sensitive information on the Internet.

The point of the iframe is to contain the damage from any possible compromise. If PAYMENTIFRAME.COM is insecure (heh), you still aren't going to lose user sessions to your actual application.

Re: Payment iframe - the easiest way to insert Stripe into your website

#39

Post by cperciva »

staunch wrote: post #37

If I was Stripe I'd be politely asking you to take this down. It's using their trademark (presumably) without permission and encouraging their users to do something very inadvisable. Offering to host this seems like a really bad idea. I know you're well meaning and trustworthy, but this shouldn't be run by a third party. For long term reliability reasons as much as security.

I showed it to people at Stripe before announcing it.

Re: Payment iframe - the easiest way to insert Stripe into your website

#40

Post by DASD »

tptacek wrote: post #36
bentlegen wrote: post #29

Earlier quoted context omitted.

The book describes techniques that Stripe could use in developing their own iframed credit card form. I'd only trust a solution from them directly.

That doesn't make any sense, because the whole point of PAYMENTIFRAME.COM is that you don't trust Stripe. Colin implemented this because besides credit card numbers , he was unwilling to give Stripe control over his website. Colin's users trust him with things that are much more sensitive than credit card numbers.

People trust Stripe. I think the issue here is Javascript and origin-policy and relinquishing control. When Stripe releases their version of STRIPEPAYMENTIFRAME.COM as an iframe solution then this can go away. I believe Colin mentioned a need for this now rather than waiting for Stripe.

Interesting side note: Yes I know it's only meant to be a demonstration site but PAYMENTIFRAME.COM is using Google Analytics. Oh HAI GA...what's my Security Code again? Just needed a nice chuckle before I head back from lunch.

Post reply on HN