5 ms·

Stripe is meant for developers, and it is quite easy to integrate using their javascript api. If you can code a form you write basic javascript you can integrat

Stripe is meant for developers, and it is quite easy to integrate using their javascript api. If you can code a form you write basic javascript you can integrate stripe.

xyzzyb 14y ago
Exactly. Stripe is probably one of the easiest integrations I've ever done. In fact, their tutorials are so well written and their signup so frictionless that I'd say that any interested website creator should have little trouble setting up a form actually using stripe instead of an iframe.
- infinite8s 14y ago
  The whole point of the iframe is that it prevents the code from inside the iframe (ie the payment handling code that sends data to stripe) from having access to the parent page's data. Sometimes the CC info isn't the most sensitive info a user has given that website (particularly for a service that manages your online backups).
pilif 14y ago
By including their JS, you give them full access to all of the contents of your payment page and depending on how you have configured your session cookie or depending on the browser, full access to the users session. Now in general, you can probably trust them, but what if they are compromised? By using an iframe you make sure that they do not get access to any information on your page - much less the users session cookie.
- JSadowski 14y ago
  And you can accomplish the same thing by using an iframe that you have full control over. Instead, if you use this service, you're trusting another 3rd party site to be available and to not be compromised.
  - tptacek 14y ago
    That is true, but the point is that the only thing that is going to be compromised is the data that would be going to Stripe. I know it is shocking to many of you to hear this, but the data Stripe collects is not really the most sensitive information on the Internet. The point of the iframe is to contain the damage from any possible compromise. If PAYMENTIFRAME.COM is insecure (heh), you still aren't going to lose user sessions to your actual application.
    - JSadowski 14y ago
      No, just potentially their credit card information.
      - tptacek 14y ago
        Again: that is not always the most sensitive things users have. I give my credit card to random people who work at gas stations. I do not give them passwords.
        JSadowski 14y ago
        Just because it isn't most-sensitive doesn't mean that breaching the data isn't a problem.
cperciva 14y ago
I've been hanging out in the Stripe Campfire chat for the past week. There's a rather scary number of people who need something like this.

Stripe is meant for developers, and it is quite easy to integrate using their javascript api. If you can code a form you write basic javascript you can integrate stripe.

xyzzyb 14y ago

Exactly. Stripe is probably one of the easiest integrations I've ever done. In fact, their tutorials are so well written and their signup so frictionless that I'd say that any interested website creator should have little trouble setting up a form actually using stripe instead of an iframe.

infinite8s 14y ago
The whole point of the iframe is that it prevents the code from inside the iframe (ie the payment handling code that sends data to stripe) from having access to the parent page's data. Sometimes the CC info isn't the most sensitive info a user has given that website (particularly for a service that manages your online backups).

pilif 14y ago

By including their JS, you give them full access to all of the contents of your payment page and depending on how you have configured your session cookie or depending on the browser, full access to the users session. Now in general, you can probably trust them, but what if they are compromised? By using an iframe you make sure that they do not get access to any information on your page - much less the users session cookie.

JSadowski 14y ago
And you can accomplish the same thing by using an iframe that you have full control over. Instead, if you use this service, you're trusting another 3rd party site to be available and to not be compromised.
- tptacek 14y ago
  That is true, but the point is that the only thing that is going to be compromised is the data that would be going to Stripe. I know it is shocking to many of you to hear this, but the data Stripe collects is not really the most sensitive information on the Internet. The point of the iframe is to contain the damage from any possible compromise. If PAYMENTIFRAME.COM is insecure (heh), you still aren't going to lose user sessions to your actual application.
  - JSadowski 14y ago
    No, just potentially their credit card information.
    - tptacek 14y ago
      Again: that is not always the most sensitive things users have. I give my credit card to random people who work at gas stations. I do not give them passwords.
      - JSadowski 14y ago
        Just because it isn't most-sensitive doesn't mean that breaching the data isn't a problem.

cperciva 14y ago

I've been hanging out in the Stripe Campfire chat for the past week. There's a rather scary number of people who need something like this.