If you're letting people enter in their credit card information at any point for any reason you MUST get an SSL certificate and force people to use a TLS secured connection.
Infosec 101
Infosec 101
It doesn't include any real verification, so it doesn't give any assurance that you are who you purport to be, but it at least prevents people's credit card numbers from being sent across the web in plain text.
Which is probably how no one individual's card info was stolen, ever.
What's to stop a malicious MITM (using an iframe, say) from fucking with Stripe's javascript during runtime if you're not using HTTPS yourself?
EDIT: turns out that Stripe themselves recommend SSL[1] for the same reasons we both guessed:
Do I need to use SSL/TLS on my payment pages?
Yes, for a couple of reasons:
* It's more secure. In particular, it significantly reduces your risk of being exposed to a man-in-the-middle attack.
* Users correctly feel more comfortable sharing their payment information on pages visibly served over SSL. Your conversion rate is likely to be higher if your pages are served over SSL/TLS, too.