6 ms·

You may be frustrated with how Stripe is responding, but why would using another payment provider solve the root issue? Does your site use a captcha in the sub

by here4U 3y ago

You may be frustrated with how Stripe is responding, but why would using another payment provider solve the root issue? Does your site use a captcha in the subscription flow to prevent card testing?

tempaccount3333 3y ago
It has nothing to do with our website. The card testing happens outside our website.
- tempaccount3333 3y ago
  Stripe indicated to me they put in a captcha on their end
  - edwinwee 3y ago
    (Edwin from Stripe here.) I think we _may_ have chatted? (Hard to tell with tempaccount name.) Could you email me at edwin@stripe.com and link to this thread?
    - tempaccount3333 3y ago
      I'm just wondering why I have to post here to get your attention on this?
      - decremental 3y ago
        [dead]
      - INGSOCIALITE 3y ago
        Because here it’s public and they want to save face. When it’s private they dgaf because it doesn’t affect other potential or current clients who might be swayed away from them
    - lol_stripe 3y ago
      > (Edwin from Stripe here.) I think we _may_ have chatted? (Hard to tell with tempaccount name.) Could you email me at edwin@stripe.com and link to this thread? I am so tired of hearing this. Even worse, you just openly admitted that Stripe has extremely broken processes: "I think we _may_ have chatted?" Why did that go dark? Did it go dark? Did OP go dark? We'll never know. We just know that Edwin is here for tech support: it's an HN meme. We don't have many of those here. I'm genuinely disappointed that unless someone complains on [searches Google for your email] channels, they get burned. There are tons of those small companies, entrepreneurs, and others who are getting hosed. I understand there's no incentive to fixing those processes. I couldn't wake up every day and admit to myself that there are certain classes of customers who, despite having equal issues, get preferential treatment because they're loud. This is on the front page right now: https://news.ycombinator.com/item?id=36788274 https://news.ycombinator.com/item?id=36788274 But as an empath it hurts me. As someone who has transacted hundreds of millions through Stripe, I'm just floored. It was relatively nuanced before — the support — but this admission just shocks me.
      - dbbk 3y ago
        How the hell is the guy supposed to be able to identify the account from this post? It gives no identification.
        tempaccount3333 3y ago
        I have another post they commented on. They can see my historical posts.
      - edwinwee 3y ago
        "May have" because OP's HN name is "tempaccount3333", and I did ask them to email me once before, but I don't see anything—so I need them to reach out so I can identify their account and see what's going on. There's no identifying info here (name or business) and we don't see any emails referencing this thread.
- dbbk 3y ago
  Aren't you able to disable checkouts from outside your website?
  - CameronNemo 3y ago
    Hopefully their keys did not leak...
    - tempaccount3333 3y ago
      it's a public key
tothrowaway 3y ago
Indeed. The problem may even be worse with other systems. There are other trivial ways to prevent unsophisticated card testing. For example, I have a card tester who visits my checkout page every day via a direct link (he must have bookmarked it). Little does he know, the real checkout page is now located at a different URL. So I just reject every transaction at that page.
twelve40 3y ago
bin attacks and card attacks plague many different payment providers, first-hand experience. I'm not aware of much that can be done about this at the payment provider, they also suffer.
- tempaccount3333 3y ago
  Saying they suffer is a bit much. At best they get to collect their fee if there never ends up being a chargeback. If there is a chargeback they don't have to pay the chargeback fee. Sounds like it is an overall win for them to let these slide through.
  - twelve40 3y ago
    nope, they get a lot of crap from customers and reputation damage. It's a p0 incident in places where I worked (not stripe, but i can't imagine why they alone would be glad to repel customers for a couple bucks), and everyone absolutely hates it.

by here4U 3y ago

You may be frustrated with how Stripe is responding, but why would using another payment provider solve the root issue? Does your site use a captcha in the subscription flow to prevent card testing?

tempaccount3333 3y ago

It has nothing to do with our website. The card testing happens outside our website.

tempaccount3333 3y ago
Stripe indicated to me they put in a captcha on their end
- edwinwee 3y ago
  (Edwin from Stripe here.) I think we _may_ have chatted? (Hard to tell with tempaccount name.) Could you email me at edwin@stripe.com and link to this thread?
  - tempaccount3333 3y ago
    I'm just wondering why I have to post here to get your attention on this?
    - decremental 3y ago
      [dead]
    - INGSOCIALITE 3y ago
      Because here it’s public and they want to save face. When it’s private they dgaf because it doesn’t affect other potential or current clients who might be swayed away from them
  - lol_stripe 3y ago
    > (Edwin from Stripe here.) I think we _may_ have chatted? (Hard to tell with tempaccount name.) Could you email me at edwin@stripe.com and link to this thread? I am so tired of hearing this. Even worse, you just openly admitted that Stripe has extremely broken processes: "I think we _may_ have chatted?" Why did that go dark? Did it go dark? Did OP go dark? We'll never know. We just know that Edwin is here for tech support: it's an HN meme. We don't have many of those here. I'm genuinely disappointed that unless someone complains on [searches Google for your email] channels, they get burned. There are tons of those small companies, entrepreneurs, and others who are getting hosed. I understand there's no incentive to fixing those processes. I couldn't wake up every day and admit to myself that there are certain classes of customers who, despite having equal issues, get preferential treatment because they're loud. This is on the front page right now: https://news.ycombinator.com/item?id=36788274 https://news.ycombinator.com/item?id=36788274 But as an empath it hurts me. As someone who has transacted hundreds of millions through Stripe, I'm just floored. It was relatively nuanced before — the support — but this admission just shocks me.
    - dbbk 3y ago
      How the hell is the guy supposed to be able to identify the account from this post? It gives no identification.
      - tempaccount3333 3y ago
        I have another post they commented on. They can see my historical posts.
    - edwinwee 3y ago
      "May have" because OP's HN name is "tempaccount3333", and I did ask them to email me once before, but I don't see anything—so I need them to reach out so I can identify their account and see what's going on. There's no identifying info here (name or business) and we don't see any emails referencing this thread.
dbbk 3y ago
Aren't you able to disable checkouts from outside your website?
- CameronNemo 3y ago
  Hopefully their keys did not leak...
  - tempaccount3333 3y ago
    it's a public key

tothrowaway 3y ago

Indeed. The problem may even be worse with other systems. There are other trivial ways to prevent unsophisticated card testing. For example, I have a card tester who visits my checkout page every day via a direct link (he must have bookmarked it). Little does he know, the real checkout page is now located at a different URL. So I just reject every transaction at that page.

twelve40 3y ago

bin attacks and card attacks plague many different payment providers, first-hand experience. I'm not aware of much that can be done about this at the payment provider, they also suffer.

tempaccount3333 3y ago
Saying they suffer is a bit much. At best they get to collect their fee if there never ends up being a chargeback. If there is a chargeback they don't have to pay the chargeback fee. Sounds like it is an overall win for them to let these slide through.
- twelve40 3y ago
  nope, they get a lot of crap from customers and reputation damage. It's a p0 incident in places where I worked (not stripe, but i can't imagine why they alone would be glad to repel customers for a couple bucks), and everyone absolutely hates it.