4 ms·

If you're going to trust a website with your credit card you probably trust them enough to not try and steal your paypal information. There isn't a way to solv

If you're going to trust a website with your credit card you probably trust them enough to not try and steal your paypal information. There isn't a way to solve this issue without hurting the user experience. For some websites, that's a fair trade off. Maybe a browser could put in a "Verify iframes" button that would show you the payment form is actually coming from PayPal.

pfg 12y ago
Not having to trust a website with my credit card details is one of the main reasons I tend to use PayPal at all, and it's something they're actively advertising with [1]. I understand it's hard to find a solution that offers both good UX and security. Maybe they could have at least added a link to open the login in a new window on their domain for users who want to easily verify it's legit. Still, I think it's pretty irresponsible to teach users that entering login credentials on (essentially) a third-party website is okay. [1]: https://www.paypal.com/us/webapps/mpp/paypal-safety-and-security https://www.paypal.com/us/webapps/mpp/paypal-safety-and-secu... @ Who you are is how you pay
jfoster 12y ago
There is a way to do this securely whilst improving the user experience. The merchant site can run PayPal's js, which would check whether the user is signed in to PayPal. If they are signed in, the js could just display a "confirm payment" button rather than requesting credentials from the user. If they're not signed in, it could just ask the user to sign in to PayPal in a new window, where the user can verify via the browser's address bar whether they are signing into the real PayPal. Google Wallet for Digital Goods (which Google is retiring soon) does this, and I think it is the best payment user experience that has been made, so far.
- homakov 12y ago
  > the js could just display a "confirm payment" button rather than requesting credentials from the user. clickjacking
jrochkind1 12y ago
Ah, but part of the point of paying for something via paypal is that I _don't_ need to trust the website with my credit card information, I only need to trust paypal.

pfg 12y ago

Not having to trust a website with my credit card details is one of the main reasons I tend to use PayPal at all, and it's something they're actively advertising with [1]. I understand it's hard to find a solution that offers both good UX and security. Maybe they could have at least added a link to open the login in a new window on their domain for users who want to easily verify it's legit. Still, I think it's pretty irresponsible to teach users that entering login credentials on (essentially) a third-party website is okay. [1]: https://www.paypal.com/us/webapps/mpp/paypal-safety-and-security https://www.paypal.com/us/webapps/mpp/paypal-safety-and-secu... @ Who you are is how you pay

jfoster 12y ago

There is a way to do this securely whilst improving the user experience. The merchant site can run PayPal's js, which would check whether the user is signed in to PayPal. If they are signed in, the js could just display a "confirm payment" button rather than requesting credentials from the user. If they're not signed in, it could just ask the user to sign in to PayPal in a new window, where the user can verify via the browser's address bar whether they are signing into the real PayPal. Google Wallet for Digital Goods (which Google is retiring soon) does this, and I think it is the best payment user experience that has been made, so far.

homakov 12y ago
> the js could just display a "confirm payment" button rather than requesting credentials from the user. clickjacking

jrochkind1 12y ago

Ah, but part of the point of paying for something via paypal is that I _don't_ need to trust the website with my credit card information, I only need to trust paypal.