News for hackers. Stuff that matters.

A comment on Recurly.js library released for secure, customizable checkout forms. Parent comment

Re:Recurly.js library released for secure, customizable chec... by isaachall on Monday August 22, 2011 @08:36PM (#2914798)
The Recurly.js library dramatically reduces PCI compliance scope because the sensitive cardholder data does not pass thru your servers. There's a lot of additional PCI compliance issues when the credit card numbers pass thru your server, even if it only resides in memory during the request. Instead, the data is sent directly from the web browser to Recurly, who is PCI Level 1 Compliant.

Obviously, you still have to maintain a secure web server regardless of how you collect payments. That means protecting your users from cross site scripting.

[ Parent | on HN ]
Re:Recurly.js library released for secure, customizable chec... by trungonnews on Monday August 22, 2011 @09:19PM (#2914906)
You're missing the point.

While the user is entering the credit card number, there's a chance that someone can intercept and steal the CC.

You can easily solve this problem by putting the credit card form inside your own iframe. :)

[ Parent | on HN ]
Re:Recurly.js library released for secure, customizable chec... by tptacek on Monday August 22, 2011 @09:40PM (#2914969)
Madness. Are users expected to check the DOM tree before they type their credit card details in to make sure they're sending their info to the iframe they expect to?

The rule should be: if your app has a credit card form under its own banner, the whole thing is implicated for PCI assessments. But that's not the rule.

[ Parent | on HN ]
Re:Recurly.js library released for secure, customizable chec... by robfig on Monday August 22, 2011 @10:40PM (#2915104)
PCI Compliance is about protecting consumers from third parties, not from the merchant.

As part of Compliance, the merchant attests that he never handles the cardholder information, and that closes off huge portions of it.

[ Parent | on HN ]
Re:Recurly.js library released for secure, customizable chec... by drivebyacct2 on Monday August 22, 2011 @08:38PM (#2914802)
... which thus precludes the security (and thus simplicity) aspect of Recurly.js.
[ Parent | on HN ]
Re:Recurly.js library released for secure, customizable chec... by pbreit on Monday August 22, 2011 @09:06PM (#2914856)
Recurly still supports hosted payment pages in which case the merchant doesn't need SSL.

As far as I know, Recurly and Stripe are the only two processors providing JavaScript libraries to tokenize credit card information such that merchants do not handle the credit card information that suscepts them to PCI compliance.

[ Parent | on HN ]
Re:Recurly.js library released for secure, customizable chec... by trungonnews on Monday August 22, 2011 @09:21PM (#2914914)
socialgold had a similar product before google acquired it.
[ Parent | on HN ]