5 ms·

If you're letting people enter in their credit card information at any point for any reason you MUST get an SSL certificate and force people to use a TLS secure

by twrobel 12y ago

If you're letting people enter in their credit card information at any point for any reason you MUST get an SSL certificate and force people to use a TLS secured connection. Infosec 101

deleted 12y ago
[deleted]
twrobel 12y ago
At a bare minimum you can get a free SSL cert here - https://www.startssl.com/?app=1 https://www.startssl.com/?app=1 It doesn't include any real verification, so it doesn't give any assurance that you are who you purport to be, but it at least prevents people's credit card numbers from being sent across the web in plain text.
- MichaelGG 12y ago
  >but it at least prevents people's credit card numbers from being sent across the web in plain text. Which is probably how no one individual's card info was stolen, ever.
thebeardisred 12y ago
Admittedly that's all happening with javascript passthrough to stripe's API using https.
- gameguy43 12y ago
  This. I added https to my site to get users to stop worrying, but AFAIK you don't need it with Stripe.
- scott_karana 12y ago
  Ugh. I guess that's technically true, but it doesn't prevent me from feeling heeby-jeebies. What's to stop a malicious MITM (using an iframe, say) from fucking with Stripe's javascript during runtime if you're not using HTTPS yourself? EDIT: turns out that Stripe themselves recommend SSL[1] for the same reasons we both guessed: Do I need to use SSL/TLS on my payment pages? Yes, for a couple of reasons: * It's more secure. In particular, it significantly reduces your risk of being exposed to a man-in-the-middle attack. * Users correctly feel more comfortable sharing their payment information on pages visibly served over SSL. Your conversion rate is likely to be higher if your pages are served over SSL/TLS, too. 1 https://stripe.com/help/ssl https://stripe.com/help/ssl
- mholt 12y ago
  I think people forget that any non-HTTPS page can be tampered with in flight. For example, to deliver a form that looks like it uses Stripe but actually goes to an attacker. HTTPS is a 100% must on all pages for a business.

by twrobel 12y ago

If you're letting people enter in their credit card information at any point for any reason you MUST get an SSL certificate and force people to use a TLS secured connection. Infosec 101

deleted 12y ago

[deleted]

twrobel 12y ago

At a bare minimum you can get a free SSL cert here - https://www.startssl.com/?app=1 https://www.startssl.com/?app=1 It doesn't include any real verification, so it doesn't give any assurance that you are who you purport to be, but it at least prevents people's credit card numbers from being sent across the web in plain text.

MichaelGG 12y ago
>but it at least prevents people's credit card numbers from being sent across the web in plain text. Which is probably how no one individual's card info was stolen, ever.

thebeardisred 12y ago

Admittedly that's all happening with javascript passthrough to stripe's API using https.

gameguy43 12y ago
This. I added https to my site to get users to stop worrying, but AFAIK you don't need it with Stripe.
scott_karana 12y ago
Ugh. I guess that's technically true, but it doesn't prevent me from feeling heeby-jeebies. What's to stop a malicious MITM (using an iframe, say) from fucking with Stripe's javascript during runtime if you're not using HTTPS yourself? EDIT: turns out that Stripe themselves recommend SSL[1] for the same reasons we both guessed: Do I need to use SSL/TLS on my payment pages? Yes, for a couple of reasons: * It's more secure. In particular, it significantly reduces your risk of being exposed to a man-in-the-middle attack. * Users correctly feel more comfortable sharing their payment information on pages visibly served over SSL. Your conversion rate is likely to be higher if your pages are served over SSL/TLS, too. 1 https://stripe.com/help/ssl https://stripe.com/help/ssl
mholt 12y ago
I think people forget that any non-HTTPS page can be tampered with in flight. For example, to deliver a form that looks like it uses Stripe but actually goes to an attacker. HTTPS is a 100% must on all pages for a business.