5 ms·

> How do you find out what payment processor(s) a given site uses? I'm a developer so looking at what kind of request the application is doing when interacting

> How do you find out what payment processor(s) a given site uses? I'm a developer so looking at what kind of request the application is doing when interacting with anything involving payments. In the case of OnlyFans it was easy as they make direct requests to Stripe. In other cases, I've looked at the data structures stored in the current page by using the JS console and compare it to the API docs of various payment processors.

pottertheotter 6y ago
I'm not a web developer but I always assumed that happened on the backend, so it wouldn't be visible. I guess not?
- capableweb 6y ago
  Depends on the implementation, with Stripe you can embed their widgets directly on your website to save some development time, but you can also implement in the backend. Even though you would implement it in the backend, there is usually some details leaking (on purpose obviously) to the frontend, like identifiers (Stripes IDs are usually pretty easy to spot) or even the structure of the data can tell you which provider.
- zaroth 6y ago
  One of the easiest ways to ensure PCI compliance is never actually serving the credit card form from your server, and never seeing the response. Hence the front-end will load and send content to/from Stripe directly.
- justinholmes 6y ago
  Most websites can't/shouldn't store the card number, they embed Stripe JavaScript that sends card number to Stripe and get a token id to use on the backend later on. Can't store CCV or number without passing PCI compliance.
  - tzs 6y ago
    For the CVV you can't store it even if you have passed PCI compliance. You are only allowed to collect it for a specific transaction, and are required to forget it when that transaction is complete.
    - 8192kjshad09- 6y ago
      That can't be right. I entered my credit card information once into uber eats and I can buy food whenever without entering a CCV and my credit card is immediately charged. If this were true 1000s of large companies would not be PCI compliant.
      - athrun 6y ago
        Storing the CVV permanently is indeed strictly forbidden. The CVV is not used for purchases on a stored card.
      - deleted 6y ago
        [deleted]
      - JoeMalt 6y ago
        It’s possible to process transactions without a CVV, but it often costs slightly more due to the increased fraud risk. In the case of Uber Eats, they’ve presumably decided the increase in purchases from removing that friction makes up for the higher fee.
  - adrianmonk 6y ago
    Interesting. Do they literally embed Stripe JS? I'm not a front end developer and don't know a ton about web security, but it seems like a malicious/hacked site could still get the card number this way. The purpose of PCI compliance is to protect the number/info, so how would Stripe (and similar) get approved if they're creating a payment widget that allows third parties to snoop card numbers? Is this a PCI loophole, or is there some technical barrier preventing the third-party site from getting access?
- schwartzworld 6y ago
  The contents of the request should hopefully be encrypted, but you can easily see where the request is going.
- Kuraj 6y ago
  Very often it is an IFrame with embedded content from the payment processor.

pottertheotter 6y ago

I'm not a web developer but I always assumed that happened on the backend, so it wouldn't be visible. I guess not?

capableweb 6y ago
Depends on the implementation, with Stripe you can embed their widgets directly on your website to save some development time, but you can also implement in the backend. Even though you would implement it in the backend, there is usually some details leaking (on purpose obviously) to the frontend, like identifiers (Stripes IDs are usually pretty easy to spot) or even the structure of the data can tell you which provider.
zaroth 6y ago
One of the easiest ways to ensure PCI compliance is never actually serving the credit card form from your server, and never seeing the response. Hence the front-end will load and send content to/from Stripe directly.
justinholmes 6y ago
Most websites can't/shouldn't store the card number, they embed Stripe JavaScript that sends card number to Stripe and get a token id to use on the backend later on. Can't store CCV or number without passing PCI compliance.
- tzs 6y ago
  For the CVV you can't store it even if you have passed PCI compliance. You are only allowed to collect it for a specific transaction, and are required to forget it when that transaction is complete.
  - 8192kjshad09- 6y ago
    That can't be right. I entered my credit card information once into uber eats and I can buy food whenever without entering a CCV and my credit card is immediately charged. If this were true 1000s of large companies would not be PCI compliant.
    - athrun 6y ago
      Storing the CVV permanently is indeed strictly forbidden. The CVV is not used for purchases on a stored card.
    - deleted 6y ago
      [deleted]
    - JoeMalt 6y ago
      It’s possible to process transactions without a CVV, but it often costs slightly more due to the increased fraud risk. In the case of Uber Eats, they’ve presumably decided the increase in purchases from removing that friction makes up for the higher fee.
- adrianmonk 6y ago
  Interesting. Do they literally embed Stripe JS? I'm not a front end developer and don't know a ton about web security, but it seems like a malicious/hacked site could still get the card number this way. The purpose of PCI compliance is to protect the number/info, so how would Stripe (and similar) get approved if they're creating a payment widget that allows third parties to snoop card numbers? Is this a PCI loophole, or is there some technical barrier preventing the third-party site from getting access?
schwartzworld 6y ago
The contents of the request should hopefully be encrypted, but you can easily see where the request is going.
Kuraj 6y ago
Very often it is an IFrame with embedded content from the payment processor.