Hacker News Reader

Comment by pilif | Hacker News Reader

By including their JS, you give them full access to all of the contents of your payment page and depending on how you have configured your session cookie or depending on the browser, full access to the users session. Now in general, you can probably trust them, but what if they are compromised?

By using an iframe you make sure that they do not get access to any information on your page - much less the users session cookie.

View on HN

And you can accomplish the same thing by using an iframe that you have full control over.

Instead, if you use this service, you're trusting another 3rd party site to be available and to not be compromised.

That is true, but the point is that the only thing that is going to be compromised is the data that would be going to Stripe.

I know it is shocking to many of you to hear this, but the data Stripe collects is not really the most sensitive information on the Internet.

The point of the iframe is to contain the damage from any possible compromise. If PAYMENTIFRAME.COM is insecure (heh), you still aren't going to lose user sessions to your actual application.

No, just potentially their credit card information.

Again: that is not always the most sensitive things users have. I give my credit card to random people who work at gas stations. I do not give them passwords.

Just because it isn't most-sensitive doesn't mean that breaching the data isn't a problem.

Reply on news.ycombinator.com