4 ms·
Note: I know that there isn't SSL encryption on the checkout page. I use Stripe as my payment processor, and their JavaScript payment API means that the transac
by dshipper 15y ago
Note: I know that there isn't SSL encryption on the checkout page. I use Stripe as my payment processor, and their JavaScript payment API means that the transaction is secure even without SSL server-side because your card information never touches my server. Would love your thoughts!
- gojomo 15y agoBecause the containing page isn't SSL, there's no telling where the form really loaded from, or where it is configured to send its data. An example of this attack was the keylogging code used by Tunisia about 8 months ago: http://www.theregister.co.uk/2011/01/25/tunisia_facebook_password_slurping/ http://www.theregister.co.uk/2011/01/25/tunisia_facebook_pas... A wary expert user won't enter a single keystroke of sensitive information into a page that wasn't completely loaded by SSL with a trustworthy server certificate; no amount of in-page reassurance text/lock-icon helps.
- dshipper 15y agoThanks for the feedback, I'm definitely going to get the SSL ASAP, and just wanted to let everyone know my thought process. The way Stripe does it is actually pretty cool. When you hit submit Javascript POSTS the card data to their servers, their servers return a token and then the form is submitted. Then in Rails I take that token and post it to Stripe and the payment is completed. It's a really interesting way to be PCI compliant without SSL.
- mtogo 15y agoFantastic about adding the SSL. Just a note though: Without having SSL on the checkout page, i could MITM one of your users and replace that javascript on your page with my own potentially malicious javascript. Looks like a great product and the pricing is very fair. I'll remember this if i ever have a site or project i need reviewed.