3 ms·
Do you not think the way you have presented it is encouraging people to use it? I love Stripe, I love people hacking and creating new cool things but an emergi
by TomGullen 14y ago
Do you not think the way you have presented it is encouraging people to use it?
I love Stripe, I love people hacking and creating new cool things but an emerging trend I'm seeing with Stripe is that people are really not taking the security of the CC numbers their customers have entrusted to them as cautiously and as securely as they should.
- cperciva 14y agoIt's available for people to use if they want, sure. I expect Stripe to offer a similar service soon too (at which point that issue goes away, since people are already trusting Stripe with their card details). I'm trusting people to decide which risks they want to take -- I'm providing tools, not dictating policy.
- ceejayoz 14y agoMaybe the FAQ should include a "Q: Why should I trust your domain to host this for me? A: You shouldn't. This is a sample, you should implement it yourself for security."
- cperciva 14y agoGood point, added. I thought it was obvious, but given some of the comments here, I guess it wasn't obvious enough.
- ceejayoz 14y agoThanks! I think it's obvious to most people here, but Stripe's targeted at essentially everyone. It's quite possible that someone'd stumble across your site who just learned PHP and goes "sounds good, I'll drop it in".
- cperciva 14y agoIt's quite possible that someone'd stumble across your site who just learned PHP and goes "sounds good, I'll drop it in". I'm not sure that someone would be automatically wrong to do that. People should be aware that using paymentiframe.com means trusting me to not steal their customers' credit cards and trusting me to keep the site secure, but if someone makes an informed decision to place that trust in me, I can't say that they're necessarily wrong to do so. As I said: Tools, not policy.