5 ms·
> leave it to Stripe, BrainTree, Paypal, someone trusted, with the resources to handle it. Wouldn't stripe and braintree still effectively let you handle CC on
by gingerlime 10y ago
> leave it to Stripe, BrainTree, Paypal, someone trusted, with the resources to handle it.
Wouldn't stripe and braintree still effectively let you handle CC on your own site? i.e. If someone can inject JS code there, they can in high likelihood grab CC details even if you're using stripe or braintree. Am I missing something?
- microcolonel 10y agoIt depends on how you integrate it, but yes, you're largely right. If they have your JavaScript they may have your cards.
- 3pt14159 10y agoThe difference is if you make the user click a link to Stripe's site then unless the evil JS replaces the URL with a different domain they can no longer interact with the user. And swapping out links is something that will get noticed far more easily than passively harvesting CC details.
- the_mitsuhiko 10y agoStripe does not use an iframe/redirect for protection.
- zrail 10y agoStripe Checkout is loaded in an iframe and stripe.js uses an iframe for data transmission.
- the_mitsuhiko 10y agoI know, but the credit card information for stripe.js lives in an unprotected DOM.
- collinmanderson 10y agoRight. It's sort of a loop hole where they technically use an iframe for PCI compliance, but they don't actually get any security benefit from it.
- andybak 10y agoThat's not usually how Stripe integration works, is it?