4 ms·
It's beautiful, but how does the user verify that the credit card popup form is being posted to a valid, secure site? I mean, normally you'd first be redirecte
by kennu 14y ago
It's beautiful, but how does the user verify that the credit card popup form is being posted to a valid, secure site?
I mean, normally you'd first be redirected to a trusted payment site and verify its SSL identity in the browser URL bar. Then you'd know that the trusted site will do things properly from there.
But in this case, are you just supposed to trust blindly that the Stripe-looking payment form popping up on some semi-random site will really be submitted to Stripe? Am I missing something?
- _pius 14y agoAm I missing something? Yes: most customers don't think about the question you're posing. For that question to even arise in a customer's mind, they would have to know what an iframe is. Otherwise, it's just a cool little popup that the website opened.
- lucisferre 14y agoBesides how does a pop up make it more likely to be an iframe than just any old iframe?
- gailees 14y ago100%....Most customers don't even understand https vs http. In the tech bubble, we definitely recognize things like that, but for normal people, they determine their trust by the look and brand name on the payment form. This button is the first step for stripe to start being a trusted name by more skeptical e-customers.
- kennu 14y agoI would trust Stripe, but only after seeing it verified as the owner of the SSL certificate of the website I'm using. There's way too much phishing going on for me to trust anything just shown in HTML branding.. Of course I realize that 'normal' people might trust anything, but it still won't make me trust it any more. So I'm not quite sure in what situation I would personally ever be able to use these nice Stripe button payments.
- frio 14y agoSurely that's a bad thing? It would be trivial to make an identical Javascript popup which harvested data rather than sending it off to Stripe. Yes, the current redirect-ad-infinitum workflow is reasonably trash, but this scares me a lot, and I'd personally not trust it.
- greendestiny 14y agoI think the idea would be that this is in a https payment page of the client company who you would then choose to trust (or not) as implementing the payment frame correctly. Just like if they had their own payment solution essentially.
- deleted 14y ago[deleted]
- Surio 14y agoA lot of discussion already happening at: http://news.ycombinator.com/item?id=4633443 http://news.ycombinator.com/item?id=4633443
- k3n 14y agoDon't all modern browsers warn of (or block) mixed HTTP/HTTPS content?
- brandon272 14y agoOnly if the parent page is HTTPS and tries to load HTTP content, but not vice versa. So an HTTP page loading an HTTPS iframe won't trigger an error.