5 ms·

How is that "sloppy security"? Honest question.

• Animats 12y ago
  See "http://pciguru.wordpress.com/2013/06/30/developers-beware-stripe/" http://pciguru.wordpress.com/2013/06/30/developers-beware-st.... If you accept a CVC or CVC2, the requirements are much stricter, because an attacker who can get hold of a card number with the CVC/CVC2 can buy more expensive items. Stripe works by having pages invoke their "stripe.js" within the host page. The risk of mixing payment processing input into a general site is that anything that can access the DOM can patch "stripe.js" and tap the credit card data. Since this page is very likely to be attacked, that's a big risk here. The page uses several off-site Javascript files. Attacks through the CDN that distributes "bootstrap.js", for example, might work. In 2015, payment card requirements are tightening up. Sites which use third party processors like Stripe will probably have to put credit card entry into an iframe which comes directly from the third party processor. This makes the attack surface smaller.
  • ab 12y ago
    Stripe checkout does use an iframe from checkout.stripe.com for the payment form.
    • Animats 12y ago
      Yes, it does. But that iframe is dynamically invoked by JavaScript executing in the parent page. The user can't easily see that the popup is more secure than the background page.
  • teach 12y ago
    How does having a domain-only SSL cert affect anything?