News for hackers. Stuff that matters.

A comment on 5900 online stores found skimming. Parent comment

Re:5900 online stores found skimming by 3pt14159 on Saturday October 15, 2016 @09:01AM (#12713793)
The difference is if you make the user click a link to Stripe's site then unless the evil JS replaces the URL with a different domain they can no longer interact with the user. And swapping out links is something that will get noticed far more easily than passively harvesting CC details.
[ Parent | on HN ]
Re:5900 online stores found skimming by andybak on Saturday October 15, 2016 @10:24AM (#12714012)
That's not usually how Stripe integration works, is it?
[ Parent | on HN ]
Re:5900 online stores found skimming by the_mitsuhiko on Saturday October 15, 2016 @10:21AM (#12714000)
Stripe does not use an iframe/redirect for protection.
[ Parent | on HN ]
Re:5900 online stores found skimming by zrail on Saturday October 15, 2016 @10:32AM (#12714035)
Stripe Checkout is loaded in an iframe and stripe.js uses an iframe for data transmission.
[ Parent | on HN ]
Re:5900 online stores found skimming by the_mitsuhiko on Sunday October 16, 2016 @04:36AM (#12717650)
I know, but the credit card information for stripe.js lives in an unprotected DOM.
[ Parent | on HN ]
Re:5900 online stores found skimming by collinmanderson on Saturday October 22, 2016 @01:32PM (#12769603)
Right. It's sort of a loop hole where they technically use an iframe for PCI compliance, but they don't actually get any security benefit from it.
[ Parent | on HN ]