6 ms·

The reason for processing on your own server is so you own the entire checkout experience. If you redirect he user to another site for payment, you run the risk

The reason for processing on your own server is so you own the entire checkout experience. If you redirect he user to another site for payment, you run the risk of losing track of that user. Also, the third-party’s branding may clash with your own.

bspn 9y ago
It also puts you squarely in PCI scope which is a massive burden. I believe many of the modern payment processors offer embedded iframe solutions these days where they handle the sensitive bits (card and CVV#) but allow you to style the payment form however you like.
- LesZedCB 9y ago
  to an extent yes. There is another lever, PA-DSS compliance which is less stringent than full PCI-DSS compliance because you aren't actually storing card data on your servers, they are just passing through, or pages that collect them are being rendered by that server.
robinwassen 9y ago
The third party branding can also be positive depending on your own brand trust. Made numerous payments to shoddy businesses in SE asia the last month, but since most offer PayPal as payment provider I feel confident entering my CC number.
kevin_thibedeau 9y ago
Going to a well known third party is a guarantee that my payment data isn't sitting in a poorly secured vendor database. That's more important to me than a seamless transaction. PayPal is most useful when you don't fully trust the site you are buying from to have their shit together.
- nicoburns 9y ago
  Ebay presumably doesn't have this problem though... they are large enough to be trusted on their own...
  - xab9 9y ago
    It just takes one malicious ad on the payment page... and the tempation to shove ads into the face of every customer and his dog is big. Think about java updates and a certain antivirus product as a great example of insane greed :)
  - DrScump 9y ago
    eBay itself had a major password hack in 2014.
- donatj 9y ago
  This. Entirely. I used to work for a small ecommerce webdev shop. I’ve worked on sooo many shitty insecure shopping carts over the years I simply know not to trust basically any small website asking for my card. Completely unencrypted, storing CVVs, sending CC details as GET parameters, I’ve seen it all. It’s painfully common! If a company is not a huge name, and is handling your credit card info themselves, they are mishandling your credit card information in one way or another. I guarantee it. Having been through PCI compliance, it’s no joke. It’s really not worth doing yourself in my strong opinion.
  - marcell 9y ago
    > If a company is not a huge name Not to be snarky, but a huge name is no guarantee of safety. See: Target, Equifax.
    - DrScump 9y ago
      Even eBay itself (PayPal's parent) had a major password hack in 2014.
      - Al-Khwarizmi 9y ago
        However, the advantage of PayPal is that I can buy from multiple websites while only needing to trust one entity with my credit card information. If trusting one entity can already be insecure, having to trust dozens of them is nuts.
    - bdhess 9y ago
      Parent didn’t say that. You assumed the converse.
  - kinkrtyavimoodh 9y ago
    > sending CC details as GET parameters facepalm
    - dang 9y ago
- fludlight 9y ago
  You and I and the rest of the HN crowd are concerned about this problem, but the rest of the world doesn't even know that it exists. I wonder what real world bounce rates look like for PayPal vs InsecureCart.
- rawfan 9y ago
  That's not how Stipe and similar services work. They exist to prevent your scenario. They actually work very similar to Paypal except that you don't have to be redirected to the Paypal site to enter your credentials. Instead you get a small "secured by Stripe" widget that takes the credentials (directly to Stripes PCI compliant servers so that yours don't have to be). As a reply you'll get some kind of token that you can use to actually charge the credit card (or SEPA, or whatever else). It's a secure way of handling payment without the "we're now redirecting you to some payment site" which BY THE WAY Paypal themselves offer in the form of their Braintree payment services.
- krutzger 9y ago
  I see a possible problem with that statement: starting from a poorly secured sellers site, users can't really be sure if he ends up on the real PayPal page anyway.
rhino369 9y ago
I like the ease of use of pay pal, but the redirect is a pain point for sure. Occasionally I'm not sure if I've actually purchased something.
kbart 9y ago
From a user perspective, I wouldn't trust a site that uses it's own payment processor, unless you are Amazon, Ebay etc. Double that if you ask for credit card details. Redirecting to a well-known payment processor (PayPal etc.) guarantees that I can pay safely.
- clintonb 9y ago
  > From a user perspective, I wouldn't trust a site that uses it's own payment processor, unless you are Amazon, Ebay etc. "etc."? That leaves a lot of companies where you potentially do business. Note that the size of the company isn't necessarily an indicator that the company knows how to safely handle payment information.
jeremiep 9y ago
Since when does checkout needs to be an "experience"? I'd much rather trust Paypal than a company worried about losing track of me or that I might see a different branding. That different branding is the very reason I'm doing the transaction in the first place: I trust Paypal way more than any company's self-hosted checkout.
- clintonb 9y ago
  Checkout has been an experience for decades. The candy/magazines by the checkout line in your grocery store are now ads on the cart page. Amazon even promotes using a specific credit card in some cases: Use Discover to save 5%, or Save 10% when you get an Amazon Visa.

bspn 9y ago

It also puts you squarely in PCI scope which is a massive burden. I believe many of the modern payment processors offer embedded iframe solutions these days where they handle the sensitive bits (card and CVV#) but allow you to style the payment form however you like.

LesZedCB 9y ago
to an extent yes. There is another lever, PA-DSS compliance which is less stringent than full PCI-DSS compliance because you aren't actually storing card data on your servers, they are just passing through, or pages that collect them are being rendered by that server.

robinwassen 9y ago

The third party branding can also be positive depending on your own brand trust. Made numerous payments to shoddy businesses in SE asia the last month, but since most offer PayPal as payment provider I feel confident entering my CC number.

kevin_thibedeau 9y ago

Going to a well known third party is a guarantee that my payment data isn't sitting in a poorly secured vendor database. That's more important to me than a seamless transaction. PayPal is most useful when you don't fully trust the site you are buying from to have their shit together.

nicoburns 9y ago
Ebay presumably doesn't have this problem though... they are large enough to be trusted on their own...
- xab9 9y ago
  It just takes one malicious ad on the payment page... and the tempation to shove ads into the face of every customer and his dog is big. Think about java updates and a certain antivirus product as a great example of insane greed :)
- DrScump 9y ago
  eBay itself had a major password hack in 2014.
donatj 9y ago
This. Entirely. I used to work for a small ecommerce webdev shop. I’ve worked on sooo many shitty insecure shopping carts over the years I simply know not to trust basically any small website asking for my card. Completely unencrypted, storing CVVs, sending CC details as GET parameters, I’ve seen it all. It’s painfully common! If a company is not a huge name, and is handling your credit card info themselves, they are mishandling your credit card information in one way or another. I guarantee it. Having been through PCI compliance, it’s no joke. It’s really not worth doing yourself in my strong opinion.
- marcell 9y ago
  > If a company is not a huge name Not to be snarky, but a huge name is no guarantee of safety. See: Target, Equifax.
  - DrScump 9y ago
    Even eBay itself (PayPal's parent) had a major password hack in 2014.
    - Al-Khwarizmi 9y ago
      However, the advantage of PayPal is that I can buy from multiple websites while only needing to trust one entity with my credit card information. If trusting one entity can already be insecure, having to trust dozens of them is nuts.
  - bdhess 9y ago
    Parent didn’t say that. You assumed the converse.
- kinkrtyavimoodh 9y ago
  > sending CC details as GET parameters facepalm
  - dang 9y ago
fludlight 9y ago
You and I and the rest of the HN crowd are concerned about this problem, but the rest of the world doesn't even know that it exists. I wonder what real world bounce rates look like for PayPal vs InsecureCart.
rawfan 9y ago
That's not how Stipe and similar services work. They exist to prevent your scenario. They actually work very similar to Paypal except that you don't have to be redirected to the Paypal site to enter your credentials. Instead you get a small "secured by Stripe" widget that takes the credentials (directly to Stripes PCI compliant servers so that yours don't have to be). As a reply you'll get some kind of token that you can use to actually charge the credit card (or SEPA, or whatever else). It's a secure way of handling payment without the "we're now redirecting you to some payment site" which BY THE WAY Paypal themselves offer in the form of their Braintree payment services.
krutzger 9y ago
I see a possible problem with that statement: starting from a poorly secured sellers site, users can't really be sure if he ends up on the real PayPal page anyway.

rhino369 9y ago

I like the ease of use of pay pal, but the redirect is a pain point for sure. Occasionally I'm not sure if I've actually purchased something.

kbart 9y ago

From a user perspective, I wouldn't trust a site that uses it's own payment processor, unless you are Amazon, Ebay etc. Double that if you ask for credit card details. Redirecting to a well-known payment processor (PayPal etc.) guarantees that I can pay safely.

clintonb 9y ago
> From a user perspective, I wouldn't trust a site that uses it's own payment processor, unless you are Amazon, Ebay etc. "etc."? That leaves a lot of companies where you potentially do business. Note that the size of the company isn't necessarily an indicator that the company knows how to safely handle payment information.

jeremiep 9y ago

Since when does checkout needs to be an "experience"? I'd much rather trust Paypal than a company worried about losing track of me or that I might see a different branding. That different branding is the very reason I'm doing the transaction in the first place: I trust Paypal way more than any company's self-hosted checkout.

clintonb 9y ago
Checkout has been an experience for decades. The candy/magazines by the checkout line in your grocery store are now ads on the cart page. Amazon even promotes using a specific credit card in some cases: Use Discover to save 5%, or Save 10% when you get an Amazon Visa.