3 ms·

The problem is when companies like Stripe provide misleading or patently false guidance in order to build their business. It's very amazing when people buy-int

The problem is when companies like Stripe provide misleading or patently false guidance in order to build their business. It's very amazing when people buy-into the idea of completely side-stepping PCI by implementing SSL & some Javascript within their same origin.

Silhouette 13y ago
Where did this same origin fixation you have come from? You keep mentioning it, but stripe.js or checkout.js would normally be loaded directly from a subdomain of stripe.com over HTTPS, and the pages that load that JS, which really are coming from the vendor's own domain, are also required to be served via HTTPS according to Stripe's guidance. To compromise that set-up without compromising the communications infrastructure or Stripe itself, an attacker would need to be able to modify the files served from the vendor's system. Anyone who can do that can just as easily serve a page that puts a form up asking for card details but then simply e-mails anything submitted to the accountant of their favourite Nigerian prince, never going anywhere near Stripe. So what is it you're concerned about here and how do you think anything in PCI DSS actually makes it better?
- patcheudor 13y ago
  The reference to the Stripe JS must come from the same origin of the merchant. Look at Stripe's own example, the form is hosted in the same origin of the merchant, therefore if there are any security flaws which would allow a bad guy to publish their own JS or markup within the merchant domain the security of the collection form is done. It doesn't matter that the JS is loaded from stripe.com because that reference can be stopped or replaced.
  - Silhouette 13y ago
    So what would you have everyone do instead, in your world where complying with overheads imposed by PCI and the like don't matter? Sure, you could mandate that every legitimate small business collecting credit card information be subject to heavyweight audit processes and be compelled to institute enterprise-grade everything. If you could actually get away with that, then most small businesses would either switch to charging via other mechanisms and/or fail. It still wouldn't stop fraudsters who don't care what you or PCI or anyone else says from putting convincing-looking forms on their convincing-looking sites and exploiting anyone who is willing to put their numbers in. In practice, I doubt you actually would get away with that kind of clamp down today. If the card industry really decided to cause serious harm in a part of the economy that generally drives growth and recovery by enforcing its antiquated rules against small businesses, sooner or later it could wind up facing anything up to primary legislation to put it back in its place as governments acted to protect their national interests. Not only would that make economic sense, it would also probably be a big win for just about any politician to do it, given the current anti-bank sentiment almost everywhere. Of course this is all absurdly hypothetical, because in reality as long as small businesses are being reasonable and using common sense when it comes to securing their facilities, it is very unlikely the card schemes have anything to gain by hassling them or the modern payment services they use. I imagine they're more worried about national chain stores losing card details by the hundreds of thousands or millions.
pbreit 13y ago
If you're going to accuse a leading provider of "misleading or false guidance" you need to provide some evidence.
- patcheudor 13y ago
  The PCI council has already provided the evidence for which I've already provided the link. Read the PCI guidance surrounding tokenization. It makes it very clear. Just think about this rationally for a second. If you are a merchant who uses a bit of JavaScript provided by a payment provider and customers enter their credit-card information into the form created by that JavaScript, but instantiated by an HTTP response from the same origin of your domain how do you as a merchant side-step responsibility for PCI compliance? The simple fact of the matter and as outlined in the latest PCI guidance, you don't. Now if you instead send your customer directly to Stripe and they collect the credit card information within their same origin, then yes, PCI side-stepped. Stripe and any other vendor in this space need to behave responsibly and ensure their customers understand their PCI responsibilities.

Silhouette 13y ago

Where did this same origin fixation you have come from? You keep mentioning it, but stripe.js or checkout.js would normally be loaded directly from a subdomain of stripe.com over HTTPS, and the pages that load that JS, which really are coming from the vendor's own domain, are also required to be served via HTTPS according to Stripe's guidance. To compromise that set-up without compromising the communications infrastructure or Stripe itself, an attacker would need to be able to modify the files served from the vendor's system. Anyone who can do that can just as easily serve a page that puts a form up asking for card details but then simply e-mails anything submitted to the accountant of their favourite Nigerian prince, never going anywhere near Stripe. So what is it you're concerned about here and how do you think anything in PCI DSS actually makes it better?

patcheudor 13y ago
The reference to the Stripe JS must come from the same origin of the merchant. Look at Stripe's own example, the form is hosted in the same origin of the merchant, therefore if there are any security flaws which would allow a bad guy to publish their own JS or markup within the merchant domain the security of the collection form is done. It doesn't matter that the JS is loaded from stripe.com because that reference can be stopped or replaced.
- Silhouette 13y ago
  So what would you have everyone do instead, in your world where complying with overheads imposed by PCI and the like don't matter? Sure, you could mandate that every legitimate small business collecting credit card information be subject to heavyweight audit processes and be compelled to institute enterprise-grade everything. If you could actually get away with that, then most small businesses would either switch to charging via other mechanisms and/or fail. It still wouldn't stop fraudsters who don't care what you or PCI or anyone else says from putting convincing-looking forms on their convincing-looking sites and exploiting anyone who is willing to put their numbers in. In practice, I doubt you actually would get away with that kind of clamp down today. If the card industry really decided to cause serious harm in a part of the economy that generally drives growth and recovery by enforcing its antiquated rules against small businesses, sooner or later it could wind up facing anything up to primary legislation to put it back in its place as governments acted to protect their national interests. Not only would that make economic sense, it would also probably be a big win for just about any politician to do it, given the current anti-bank sentiment almost everywhere. Of course this is all absurdly hypothetical, because in reality as long as small businesses are being reasonable and using common sense when it comes to securing their facilities, it is very unlikely the card schemes have anything to gain by hassling them or the modern payment services they use. I imagine they're more worried about national chain stores losing card details by the hundreds of thousands or millions.

pbreit 13y ago

If you're going to accuse a leading provider of "misleading or false guidance" you need to provide some evidence.

patcheudor 13y ago
The PCI council has already provided the evidence for which I've already provided the link. Read the PCI guidance surrounding tokenization. It makes it very clear. Just think about this rationally for a second. If you are a merchant who uses a bit of JavaScript provided by a payment provider and customers enter their credit-card information into the form created by that JavaScript, but instantiated by an HTTP response from the same origin of your domain how do you as a merchant side-step responsibility for PCI compliance? The simple fact of the matter and as outlined in the latest PCI guidance, you don't. Now if you instead send your customer directly to Stripe and they collect the credit card information within their same origin, then yes, PCI side-stepped. Stripe and any other vendor in this space need to behave responsibly and ensure their customers understand their PCI responsibilities.