Hacker News Reader

Comment by evanrelf | Hacker News Reader

It doesn't matter who it's handled by, the fact is that credit card numbers are being transferred over regular, non-encrypted HTTP.

View on HN

Actually, it does matter.

The webpage might be http, but the Stripe Javascript library connects to Stripe's servers over https.

The website never sees your card number and your card number and info is never transmitted over a non-encrypted connection.

In that case the process is merely broken from a usability standpoint (a user can't click on the browser padlock to verify certificate information).

Which is ironic.

I had to look around for a minute to find the "powered by stripe" message in the bottom left corner of the overlay. Simply seeing that message shouldn't be synonymous with security. I'm trained to look for the secure lock in the address bar of the browser.

Since the page is loaded over plaintext, there's no easy way for a normal user to know that the credit card isn't being intercepted by a malicious script. It's not safe to serve a payment page over plaintext HTTP, even if it POSTs to a HTTPS endpoint as it could be modified in transit.

Stripe explains that TLS is required in their docs: https://stripe.com/help/ssl

If you read a bit further, the Stripe documentation explains that it is recommended, but not required.

You can make live transactions just fine from a regular HTTP page - whether that's a good idea or not is another issue, but making Stripe payments from an HTTPS payment page is not required from an API point of view.

They explain use cases for testing without HTTPS, but make it clear that TLS is required for production use.

Required in the 'it's a good idea because it will make the web more secure and make your customers trust you' sense, not required in the sense that it's something the API enforces.

Yes, but how do you know you're looking at the correct payment page?

The page that sends the POST request should also be verifiable as owned by the domain, otherwise I could inject a different "payment system" library, that looked like stripe to the user (unless they analyzed the traffic), but actually sends me the CC details.

From https://stripe.com/help/ssl

> Do I need to use SSL/TLS on my payment pages?

> Yes, for a couple of reasons:

> - It's more secure. In particular, it significantly reduces your risk of being exposed to a man-in-the-middle attack.

> - Users correctly feel more comfortable sharing their payment information on pages visibly served over SSL. Your conversion rate is likely to be higher if your pages are served over SSL/TLS, too.

You can test and take a look in web developer console.

Payment seems to be done using Stripe Javascript SDK, which makes all the connections using HTTPS.

Reply on news.ycombinator.com