News for hackers. Stuff that matters.

A comment on 5900 online stores found skimming. Parent comment

Re:5900 online stores found skimming by zrail on Saturday October 15, 2016 @10:32AM (#12714035)
Stripe Checkout is loaded in an iframe and stripe.js uses an iframe for data transmission.
[ Parent | on HN ]
Re:5900 online stores found skimming by the_mitsuhiko on Sunday October 16, 2016 @04:36AM (#12717650)
I know, but the credit card information for stripe.js lives in an unprotected DOM.
[ Parent | on HN ]
Re:5900 online stores found skimming by collinmanderson on Saturday October 22, 2016 @01:32PM (#12769603)
Right. It's sort of a loop hole where they technically use an iframe for PCI compliance, but they don't actually get any security benefit from it.
[ Parent | on HN ]