Hacker News Reader

Comment by perfmode | Hacker News Reader

what’s a card testing attack? how does it work?

seems odd that this is your problem. seems like something stripe should be on the hook for.

It's where attackers use your sites payment method / card processing method to make a shitload of small transactions to verify the stolen credit cards they have are valid.

Transaction succeeds? Cards valid.

That raises more questions. My product is $29 say. How come they are allowed to make a small transaction at all?

The attacker unfortunately doesn't have to use any aspect of the products that the site implements. In my situation I have different subscription levels, but the card attacker disregards all of it. Stripe really shouldn't allow for a card to be referenced without a predefined product also being referenced.

It's almost as is Stripe doesn't want to stop the attacks because they're making so much from fees

They are using my predefined products/subscriptions and aren't creating their own.

OP says they're using his public key to create their own checkout page so they can set whatever price you want.

Kind of doubtful that all you need to test cards is a public key scraped off any site that's implemented Stripe.

They are using my subscriptions. They don't set their own price

Because they generate their own links using the checkout api for clients (thus all they need is your public key)

Reply on news.ycombinator.com