Yes, but how do you know you're looking at the correct payment page? The page that sends the POST request should also be verifiable as owned by the domain, oth

Yes, but how do you know you're looking at the correct payment page? The page that sends the POST request should also be verifiable as owned by the domain, otherwise I could inject a different "payment system" library, that looked like stripe to the user (unless they analyzed the traffic), but actually sends me the CC details. From https://stripe.com/help/ssl https://stripe.com/help/ssl > Do I need to use SSL/TLS on my payment pages? > Yes, for a couple of reasons: > - It's more secure. In particular, it significantly reduces your risk of being exposed to a man-in-the-middle attack. > - Users correctly feel more comfortable sharing their payment information on pages visibly served over SSL. Your conversion rate is likely to be higher if your pages are served over SSL/TLS, too.