7 ms·
I think the point was frustration over the disconnect between PCI rules and reality, that there's no difference in security between self-hosting the form action
by harshreality 14y ago
I think the point was frustration over the disconnect between PCI rules and reality, that there's no difference in security between self-hosting the form action (over ssl, sending the cc info to the payment processor, and getting a confirm that way), compared to hosting an iframe and "not touching" credit card data. A compromised webserver means the iframe can be compromised so that the card details do hit your server.
- Ralith 14y agoThere is a difference: If the data never touches your server at all, it is impossible for you to inadvertently record it.
- deleted 14y ago[deleted]
- sp332 14y agoIf the iframe that you host is compromised, you have no idea where that info is being recorded. The fact that it doesn't touch your server doesn't ensure that your site isn't leaking numbers.
- Ralith 14y agoCertainly. But it does ensure that access to your server does not entail access to historical numbers.
- flatline3 14y agoUnless the compromise is a long-term one. Part of what PCI attempts to address is limiting legitimate access to servers, as well as preventative measures against compromise. I personally think that Stripe may be within the letter of the law, but not necessarily the spirit.