4 ms·
> but we additionally require websites to serve the enclosing page over SSL because it's both more secure and what users expect. Curious - what makes it more s
by mbesto 13y ago
> but we additionally require websites to serve the enclosing page over SSL because it's both more secure and what users expect.
Curious - what makes it more secure if it does and less secure if doesn't?
- pc 13y agoIn theory, someone could have MITM'd the page and replaced the site's publishable key with their own.
- btown 13y agoOr they could have replaced the entire Stripe JS with custom JS that presents a similar-looking dialog that submits the CC data to a third party (possibly also submitting it to Stripe to avoid detection).