4 ms·

> one of the basic principles of security is to avoid trusting people unnecessarily And asking customers to enter their CC details on your domain doesn't break

> one of the basic principles of security is to avoid trusting people unnecessarily And asking customers to enter their CC details on your domain doesn't break this rule? > a form will be submitted to your server with a stripe_token for you to process I'm assuming it just sends the Stripe token, and not CC info? If it does send CC info, I assume it's compliant with all the laws and regulations in every country?

cperciva 14y ago
asking customers to enter their CC details on your page doesn't break this rule? It doesn't break that rule for me. It is a reason why other Stripe users might want to think twice before using the iframe I host, of course. I'm assuming it just sends the Stripe token, and not CC info? Yes.
- TomGullen 14y ago
  > It is a reason why other Stripe users might want to think twice before using the iframe I host, of course. Well that's the point really. You say that a "basic principle of security" is to "avoid trusting people unnecessarily" which is exactly what this service you have created is asking people to do.
  - cperciva 14y ago
    I'm not asking anyone to use this, just making it available to people who want it and showing off a concept which people can re-implement themselves.
    - TomGullen 14y ago
      Do you not think the way you have presented it is encouraging people to use it? I love Stripe, I love people hacking and creating new cool things but an emerging trend I'm seeing with Stripe is that people are really not taking the security of the CC numbers their customers have entrusted to them as cautiously and as securely as they should.
      - cperciva 14y ago
        It's available for people to use if they want, sure. I expect Stripe to offer a similar service soon too (at which point that issue goes away, since people are already trusting Stripe with their card details). I'm trusting people to decide which risks they want to take -- I'm providing tools, not dictating policy.
        ceejayoz 14y ago
        Maybe the FAQ should include a "Q: Why should I trust your domain to host this for me? A: You shouldn't. This is a sample, you should implement it yourself for security."
        cperciva 14y ago
        Good point, added. I thought it was obvious, but given some of the comments here, I guess it wasn't obvious enough.
        ceejayoz 14y ago
        Thanks! I think it's obvious to most people here, but Stripe's targeted at essentially everyone. It's quite possible that someone'd stumble across your site who just learned PHP and goes "sounds good, I'll drop it in".
        cperciva 14y ago
        It's quite possible that someone'd stumble across your site who just learned PHP and goes "sounds good, I'll drop it in". I'm not sure that someone would be automatically wrong to do that. People should be aware that using paymentiframe.com means trusting me to not steal their customers' credit cards and trusting me to keep the site secure, but if someone makes an informed decision to place that trust in me, I can't say that they're necessarily wrong to do so. As I said: Tools, not policy.

cperciva 14y ago

asking customers to enter their CC details on your page doesn't break this rule? It doesn't break that rule for me. It is a reason why other Stripe users might want to think twice before using the iframe I host, of course. I'm assuming it just sends the Stripe token, and not CC info? Yes.

TomGullen 14y ago
> It is a reason why other Stripe users might want to think twice before using the iframe I host, of course. Well that's the point really. You say that a "basic principle of security" is to "avoid trusting people unnecessarily" which is exactly what this service you have created is asking people to do.
- cperciva 14y ago
  I'm not asking anyone to use this, just making it available to people who want it and showing off a concept which people can re-implement themselves.
  - TomGullen 14y ago
    Do you not think the way you have presented it is encouraging people to use it? I love Stripe, I love people hacking and creating new cool things but an emerging trend I'm seeing with Stripe is that people are really not taking the security of the CC numbers their customers have entrusted to them as cautiously and as securely as they should.
    - cperciva 14y ago
      It's available for people to use if they want, sure. I expect Stripe to offer a similar service soon too (at which point that issue goes away, since people are already trusting Stripe with their card details). I'm trusting people to decide which risks they want to take -- I'm providing tools, not dictating policy.
      - ceejayoz 14y ago
        Maybe the FAQ should include a "Q: Why should I trust your domain to host this for me? A: You shouldn't. This is a sample, you should implement it yourself for security."
        cperciva 14y ago
        Good point, added. I thought it was obvious, but given some of the comments here, I guess it wasn't obvious enough.
        ceejayoz 14y ago
        Thanks! I think it's obvious to most people here, but Stripe's targeted at essentially everyone. It's quite possible that someone'd stumble across your site who just learned PHP and goes "sounds good, I'll drop it in".
        cperciva 14y ago
        It's quite possible that someone'd stumble across your site who just learned PHP and goes "sounds good, I'll drop it in". I'm not sure that someone would be automatically wrong to do that. People should be aware that using paymentiframe.com means trusting me to not steal their customers' credit cards and trusting me to keep the site secure, but if someone makes an informed decision to place that trust in me, I can't say that they're necessarily wrong to do so. As I said: Tools, not policy.