Okay, my facts weren't entirely correct. The HTML of the form shows as POSTing to the same page, but the Stripe JS captures the submit event and cancels it, th

Okay, my facts weren't entirely correct. The HTML of the form shows as POSTing to the same page, but the Stripe JS captures the submit event and cancels it, then makes an API call to Stripe's server via a secure connection. It works, but it is still somewhat vulnerable to MitM attacks. I like @lessig's latest response. Much more firm and reassuring: https://twitter.com/lessig/status/461914159417147392 https://twitter.com/lessig/status/461914159417147392