Live data from Hacker News

Payment iframe - the easiest way to insert Stripe into your website

paymentiframe.com

81–84 of 84 posts

Re: Payment iframe - the easiest way to insert Stripe into your website

#81

This is a lovely form. Ideally, Stripe would offer something like this as a way to quickly generate a nice cc entry form with the intention that site owners would put the generated code directly on their site, or that stripe would host the service themselves. After all, you're already trusting them to run the service, might as well trust them to run the form too. Not that it's terribly hard to build a stripe-compatib…

site owners would put the generated code directly on their site That would defeat the protection which the Same Origin policy gives you (since the iframe would have the same origin as the rest of your site). or that stripe would host the service themselves Yes, that would be much better.

I meant that they'd put it directly on their pages, no iframe needed. Agree that it'd be much better if Stripe just did it themselves.

Re: Payment iframe - the easiest way to insert Stripe into your website

#82
post #52

Earlier quoted context omitted.

No, just potentially their credit card information.

Again: that is not always the most sensitive things users have. I give my credit card to random people who work at gas stations. I do not give them passwords.

Just because it isn't most-sensitive doesn't mean that breaching the data isn't a problem.

Re: Payment iframe - the easiest way to insert Stripe into your website

#83

Earlier quoted context omitted.

site owners would put the generated code directly on their site That would defeat the protection which the Same Origin policy gives you (since the iframe would have the same origin as the rest of your site). or that stripe would host the service themselves Yes, that would be much better.

I meant that they'd put it directly on their pages, no iframe needed. Agree that it'd be much better if Stripe just did it themselves.

I meant that they'd put it directly on their pages, no iframe needed.

At the expense of loading third party javascript directly into their pages, you mean?

Re: Payment iframe - the easiest way to insert Stripe into your website

#84

Earlier quoted context omitted.

I meant that they'd put it directly on their pages, no iframe needed. Agree that it'd be much better if Stripe just did it themselves.

I meant that they'd put it directly on their pages, no iframe needed. At the expense of loading third party javascript directly into their pages, you mean?

Yeah, I guess that misses the point of isolating the javascript, doesn't it? So, the idea is good, but has to be offered by Stripe to really minimize any exposure.
Post reply on HN