4 ms·
This is a good reason to use a technique like cperciva's payment iframe: https://www.paymentiframe.com/ https://www.paymentiframe.com/ It lets you use stripe.j
by agwa 7y ago
This is a good reason to use a technique like cperciva's payment iframe: https://www.paymentiframe.com/ https://www.paymentiframe.com/
It lets you use stripe.js (thus getting the PCI compliance benefits) without Stripe being able to spy on your visitors.
- Znafon 7y agoWhile I trust him, how can we be sure that paymentiframe.com starts serving an iframe that steals the credit cards in the future?
- Kaze404 7y agoFrom the page: > Why should I trust you? > [...] If you're worried about both, consider this a proof-of-concept which you should replicate on your own server (using a separate domain name from the rest of your site).
- tgtweak 7y agoYeah nobody should be embedding this verbatim to process payments that will fail any pci audit.
- ricardobeat 7y agoThat is so ridiculously insecure I'm surprised the author has published it without a massive disclaimer. Do NOT use an unknown third-party, without PCI qualification, to whom you have no contractual relationship, in between you and your payment provider.
- jedberg 7y agoIt says at both the top and bottom of the page not to trust him, and at the bottom it says to implement it yourself if you care about security. Seems fairly "disclaimed" to me.