3 ms·

The reference to the Stripe JS must come from the same origin of the merchant. Look at Stripe's own example, the form is hosted in the same origin of the merch

The reference to the Stripe JS must come from the same origin of the merchant. Look at Stripe's own example, the form is hosted in the same origin of the merchant, therefore if there are any security flaws which would allow a bad guy to publish their own JS or markup within the merchant domain the security of the collection form is done. It doesn't matter that the JS is loaded from stripe.com because that reference can be stopped or replaced.

Silhouette 13y ago
So what would you have everyone do instead, in your world where complying with overheads imposed by PCI and the like don't matter? Sure, you could mandate that every legitimate small business collecting credit card information be subject to heavyweight audit processes and be compelled to institute enterprise-grade everything. If you could actually get away with that, then most small businesses would either switch to charging via other mechanisms and/or fail. It still wouldn't stop fraudsters who don't care what you or PCI or anyone else says from putting convincing-looking forms on their convincing-looking sites and exploiting anyone who is willing to put their numbers in. In practice, I doubt you actually would get away with that kind of clamp down today. If the card industry really decided to cause serious harm in a part of the economy that generally drives growth and recovery by enforcing its antiquated rules against small businesses, sooner or later it could wind up facing anything up to primary legislation to put it back in its place as governments acted to protect their national interests. Not only would that make economic sense, it would also probably be a big win for just about any politician to do it, given the current anti-bank sentiment almost everywhere. Of course this is all absurdly hypothetical, because in reality as long as small businesses are being reasonable and using common sense when it comes to securing their facilities, it is very unlikely the card schemes have anything to gain by hassling them or the modern payment services they use. I imagine they're more worried about national chain stores losing card details by the hundreds of thousands or millions.

Silhouette 13y ago

So what would you have everyone do instead, in your world where complying with overheads imposed by PCI and the like don't matter? Sure, you could mandate that every legitimate small business collecting credit card information be subject to heavyweight audit processes and be compelled to institute enterprise-grade everything. If you could actually get away with that, then most small businesses would either switch to charging via other mechanisms and/or fail. It still wouldn't stop fraudsters who don't care what you or PCI or anyone else says from putting convincing-looking forms on their convincing-looking sites and exploiting anyone who is willing to put their numbers in. In practice, I doubt you actually would get away with that kind of clamp down today. If the card industry really decided to cause serious harm in a part of the economy that generally drives growth and recovery by enforcing its antiquated rules against small businesses, sooner or later it could wind up facing anything up to primary legislation to put it back in its place as governments acted to protect their national interests. Not only would that make economic sense, it would also probably be a big win for just about any politician to do it, given the current anti-bank sentiment almost everywhere. Of course this is all absurdly hypothetical, because in reality as long as small businesses are being reasonable and using common sense when it comes to securing their facilities, it is very unlikely the card schemes have anything to gain by hassling them or the modern payment services they use. I imagine they're more worried about national chain stores losing card details by the hundreds of thousands or millions.