Ugh. I guess that's technically true, but it doesn't prevent me from feeling heeby-jeebies. What's to stop a malicious MITM (using an iframe, say) from fucking

Ugh. I guess that's technically true, but it doesn't prevent me from feeling heeby-jeebies. What's to stop a malicious MITM (using an iframe, say) from fucking with Stripe's javascript during runtime if you're not using HTTPS yourself? EDIT: turns out that Stripe themselves recommend SSL[1] for the same reasons we both guessed: Do I need to use SSL/TLS on my payment pages? Yes, for a couple of reasons: * It's more secure. In particular, it significantly reduces your risk of being exposed to a man-in-the-middle attack. * Users correctly feel more comfortable sharing their payment information on pages visibly served over SSL. Your conversion rate is likely to be higher if your pages are served over SSL/TLS, too. 1 https://stripe.com/help/ssl https://stripe.com/help/ssl