2 ms·
Well, obviously all bets are off when an attacker compromises your Stripe private key. I think that's a bit of an exceptional case, it's kind of silly to blame
by nightpool 4y ago
Well, obviously all bets are off when an attacker compromises your Stripe private key. I think that's a bit of an exceptional case, it's kind of silly to blame Stripe for it when such an devastating vulnerability existed in the site.
- sgc 4y agoI agree, and think the article writer agrees, it was mainly their fault (after the actual fraudster of course). I still genuinely don't understand why such a basic thing as ip restriction is not part of the security settings in stripe. I keep looking for it thinking I must be missing it. On the user's site, it could be as simple as a fail2ban rule to deal with most of this. And no doubt he is not the only one to have done such a thing, given the number of libraries and frameworks people throw on their sites, all with their own layers of configuration.