3 ms·

I suppose the danger to this is minimized but will stripe always require an affirmative action confirming the transaction on the destination link? I can see so

by munk-a 5y ago

I suppose the danger to this is minimized but will stripe always require an affirmative action confirming the transaction on the destination link? I can see some issues related to link unfurling and pre-fetching activating the link before the user intends to interact with it along with malicious sites that inject JS to automatically follow the link. I'm curious if you have analytics collection on the first use case since it seems like a pretty risky privacy violation in terms of user tracking but honestly not far beyond shenanigans that bigger players pull (Facebook/Amazon). But I'm really curious about the second use case - the no code approach is really nice and flexible for sending payment requests over alternative media (i.e. discord) but it feels like this might open the door a bit more to phishing users via redirection - do you happen to have any security ruminations on that topic that you've made public or be willing to share?

sudhirj 5y ago
The link itself is global, not local to a transaction. So I can have the same link posted on my Github repo to support development or in my HN bio to buy me a coffee. That link then generates a checkout session when you visit it, and if the payment is actually made, then I see a payment entry in my dashboard. But the link is just a common global initiator.
edwinwee 5y ago
In short, yes—confirmation is requried. Here's an example of a payment link: https://buy.stripe.com/dR6cOd9RJ8KS8nufYZ https://buy.stripe.com/dR6cOd9RJ8KS8nufYZ. It's a single link that can be shared with anybody (not unique to one customer). On the Stripe side, nothing is collected from the customer til they click. We've thought a lot about the security side of things—one of the reasons why Payment Links has its own subdomain and the payment page is hosted by Stripe.
- abc11283 5y ago
  Very cool. One quick thought: tapping the company name doesn’t seem to do anything at the moment. It would be very cool if it would either (1) redirect to the company website or (2) a “store” or directory showing other available Payment Links. Excellent work!
  - edwinwee 5y ago
    Aha! Thanks. Great ideas.
- CallMeMarc 5y ago
  I don’t know what I expected but I guess I have a new sticker for my MacBook now. Really nice and clean process though.

by munk-a 5y ago

sudhirj 5y ago

The link itself is global, not local to a transaction. So I can have the same link posted on my Github repo to support development or in my HN bio to buy me a coffee. That link then generates a checkout session when you visit it, and if the payment is actually made, then I see a payment entry in my dashboard. But the link is just a common global initiator.

edwinwee 5y ago

In short, yes—confirmation is requried. Here's an example of a payment link: https://buy.stripe.com/dR6cOd9RJ8KS8nufYZ https://buy.stripe.com/dR6cOd9RJ8KS8nufYZ. It's a single link that can be shared with anybody (not unique to one customer). On the Stripe side, nothing is collected from the customer til they click. We've thought a lot about the security side of things—one of the reasons why Payment Links has its own subdomain and the payment page is hosted by Stripe.

abc11283 5y ago
Very cool. One quick thought: tapping the company name doesn’t seem to do anything at the moment. It would be very cool if it would either (1) redirect to the company website or (2) a “store” or directory showing other available Payment Links. Excellent work!
- edwinwee 5y ago
  Aha! Thanks. Great ideas.
CallMeMarc 5y ago
I don’t know what I expected but I guess I have a new sticker for my MacBook now. Really nice and clean process though.