4 ms·

Stripe CEO Discusses Online Payment Service

66 points by pg 15y ago

pazimzadeh 15y ago
Great interview - if only the interviewer wasn't trying to crack a joke at every opportunity.
palish 15y ago
What tactics are used to defeat fraud?
tzaman 15y ago
The sooner they get into EU market, the better. I wish they already were here.
- marquis 15y ago
  Is it a crazy idea to set up an account in the U.S. on behalf of non-U.S. sites and take payments via Stripe, with the caveat that the exchange rate might not be exact when you transfer funds a few days later? I can't imagine the many ways this could be found illegal and shut down, but with a small margin it could be profitable.
  - tzaman 15y ago
    Yeah, profitable, but somewhat scammy and, as you pointed out, probably illegal too. Not worth the fuss if you ask me.
staunch 15y ago
He did a great job with the interview. I think Stripe will be the next big YC company, on the list with Heroku, Dropbox, and Airbnb. I always find it a bit odd though, the claim that before Stripe you had to have a merchant account. I've signed up (on behalf of various projects) for PayPal's "Web Site Payments Pro" a half dozen times. It doesn't require a merchant account, the setup is quite quick, and it has a very simple API ("NVP"). It's pretty much everything Stripe is except less polished, with a slightly slower setup, and a $30/mo fee (insignificant for all my projects). I'll definitely choose Stripe next time though just because they're at least 20% more polished on all fronts and I like them a lot more than PayPal. I can't help wondering whether they just didn't know about PayPal's product or they're ignoring it for marketing purposes.
- pbreit 15y ago
  Stripe has one fairly major advantage over PayPal in its Javascript library which insulates the merchant from handling the credit card information thus making PCI compliance more realistic.
  - eurleif 15y ago
    I've only encountered Stripe as a customer, and only once, so it may just be that the merchant (Browserling) was implementing it wrong. But the merchant asked me for my credit card number on its own domain, without SSL. I trusted the site enough to believe it really used Stripe (the only verification was text saying so), and that it was secure, but there was nothing there to prove it to me. So maybe Stripe is secure, but they might want to work on appearing more trustworthy. When I've used PayPal as a customer, it asked for my credit card on its own domain, not the merchant's. Doesn't that insulate the merchant from handling credit card details at least as well as Stripe's API does?
    - storborg 15y ago
      I don't believe it's possible for a site accepting credit cards on a non-SSL page to be PCI compliant, period, no exceptions. It's trivial to MITM to steal your card info.
      - eurleif 15y ago
        The merchant's page is loaded over an insecure connection, but the credit card details are sent to Stripe's servers over a secure connection using an iframe. So it's secure; the customer just can't verify that it is without looking at the source.
        ZiadHilal 15y ago
        Not exactly. Iframes aren't involved (yuck how ugly!). Javascript is used to catch the form's submit, all the data on the form (credit card info) is sent straight to Stripe's server over https (via AJAX) and then their server sends back a response. Their implementation is both elegant and smart. Even easier than Braintree.
BryanB55 15y ago
I may start using stripe in the future. For right now we just left authorize.net (they suck) and moved to Samurai by FeeFighters: https://samurai.feefighters.com/ https://samurai.feefighters.com/ - I haven't heard much about them on HN but so far they seem great. Their implementation may not be as easy as stripe but they are slightly cheaper and, in our case, there was already a plugin for our shopping cart. Either way, I'm glad to see some changes in the payment industry.

66 points by pg 15y ago

pazimzadeh 15y ago

Great interview - if only the interviewer wasn't trying to crack a joke at every opportunity.

palish 15y ago

What tactics are used to defeat fraud?

tzaman 15y ago

The sooner they get into EU market, the better. I wish they already were here.

marquis 15y ago
Is it a crazy idea to set up an account in the U.S. on behalf of non-U.S. sites and take payments via Stripe, with the caveat that the exchange rate might not be exact when you transfer funds a few days later? I can't imagine the many ways this could be found illegal and shut down, but with a small margin it could be profitable.
- tzaman 15y ago
  Yeah, profitable, but somewhat scammy and, as you pointed out, probably illegal too. Not worth the fuss if you ask me.

staunch 15y ago

He did a great job with the interview. I think Stripe will be the next big YC company, on the list with Heroku, Dropbox, and Airbnb. I always find it a bit odd though, the claim that before Stripe you had to have a merchant account. I've signed up (on behalf of various projects) for PayPal's "Web Site Payments Pro" a half dozen times. It doesn't require a merchant account, the setup is quite quick, and it has a very simple API ("NVP"). It's pretty much everything Stripe is except less polished, with a slightly slower setup, and a $30/mo fee (insignificant for all my projects). I'll definitely choose Stripe next time though just because they're at least 20% more polished on all fronts and I like them a lot more than PayPal. I can't help wondering whether they just didn't know about PayPal's product or they're ignoring it for marketing purposes.

pbreit 15y ago
Stripe has one fairly major advantage over PayPal in its Javascript library which insulates the merchant from handling the credit card information thus making PCI compliance more realistic.
- eurleif 15y ago
  I've only encountered Stripe as a customer, and only once, so it may just be that the merchant (Browserling) was implementing it wrong. But the merchant asked me for my credit card number on its own domain, without SSL. I trusted the site enough to believe it really used Stripe (the only verification was text saying so), and that it was secure, but there was nothing there to prove it to me. So maybe Stripe is secure, but they might want to work on appearing more trustworthy. When I've used PayPal as a customer, it asked for my credit card on its own domain, not the merchant's. Doesn't that insulate the merchant from handling credit card details at least as well as Stripe's API does?
  - storborg 15y ago
    I don't believe it's possible for a site accepting credit cards on a non-SSL page to be PCI compliant, period, no exceptions. It's trivial to MITM to steal your card info.
    - eurleif 15y ago
      The merchant's page is loaded over an insecure connection, but the credit card details are sent to Stripe's servers over a secure connection using an iframe. So it's secure; the customer just can't verify that it is without looking at the source.
      - ZiadHilal 15y ago
        Not exactly. Iframes aren't involved (yuck how ugly!). Javascript is used to catch the form's submit, all the data on the form (credit card info) is sent straight to Stripe's server over https (via AJAX) and then their server sends back a response. Their implementation is both elegant and smart. Even easier than Braintree.

BryanB55 15y ago

I may start using stripe in the future. For right now we just left authorize.net (they suck) and moved to Samurai by FeeFighters: https://samurai.feefighters.com/ https://samurai.feefighters.com/ - I haven't heard much about them on HN but so far they seem great. Their implementation may not be as easy as stripe but they are slightly cheaper and, in our case, there was already a plugin for our shopping cart. Either way, I'm glad to see some changes in the payment industry.