News for hackers. Stuff that matters.

A comment on New version of Stripe Checkout. Parent comment

Re:New version of Stripe Checkout by CodeWriter23 on Wednesday April 24, 2019 @10:01PM (#19744377)
Are you speaking about real threats that cannot be mitigated by best practices, or theoretical threats of the future? I guess in other words, I’m under the impression using Stripe and following OWASP and script signing that my customers are safe. If I’m incorrect please pass me a clue.
[ Parent | on HN ]
Re:New version of Stripe Checkout by kalleboo on Thursday April 25, 2019 @07:57AM (#19747111)
As a customer, how do I verify that the merchant is following best practices and hasn't by mistake forgotten some ad script enabled on the payment page?

With PayPal as long as I only enter my password on paypal dot com I know I'm safe.

[ Parent | on HN ]
Re:New version of Stripe Checkout by CodeWriter23 on Thursday April 25, 2019 @12:12PM (#19749588)
If you’re very careful and copy/paste the PayPal URL into an editor and verify you didn’t get sent to PayPal.com.evil.domain, then you’re very likely to be safe.
[ Parent | on HN ]
Re:New version of Stripe Checkout by TazeTSchnitzel on Thursday April 25, 2019 @04:44PM (#19752348)
I don't need to do that, browsers carefully show the actual domain in ways to avoid that problem since a few years now.
[ Parent | on HN ]