The difference is if you make the user click a link to Stripe's site then unless the evil JS replaces the URL with a different domain they can no longer interact with the user. And swapping out links is something that will get noticed far more easily than passively harvesting CC details.
That's not usually how Stripe integration works, is it?
Re:5900 online stores found skimming
by the_mitsuhiko on Saturday October 15, 2016 @10:21AM
(#12714000)
Stripe does not use an iframe/redirect for protection.
Stripe Checkout is loaded in an iframe and stripe.js uses an iframe for data transmission.
Re:5900 online stores found skimming
by the_mitsuhiko on Sunday October 16, 2016 @04:36AM
(#12717650)
I know, but the credit card information for stripe.js lives in an unprotected DOM.
Re:5900 online stores found skimming
by collinmanderson on Saturday October 22, 2016 @01:32PM
(#12769603)
Right. It's sort of a loop hole where they technically use an iframe for PCI compliance, but they don't actually get any security benefit from it.
Re:5900 online stores found skimming
by microcolonel on Saturday October 15, 2016 @08:33AM
(#12713740)
It depends on how you integrate it, but yes, you're largely right. If they have your JavaScript they may have your cards.
Wouldn't stripe and braintree still effectively let you handle CC on your own site? i.e. If someone can inject JS code there, they can in high likelihood grab CC details even if you're using stripe or braintree. Am I missing something?