Ask HN: How do I stop card testing attacks on my Stripe account?

Re:Ask HN: How do I stop card testing attacks on my Stripe a... by tempaccount3333 on Monday April 24, 2023 @12:28AM (#35683651)

Unfortunately, the attacks are happening completely outside of my website. The attacker is generating a Stripe Checkout page using my public key - which I have rotated several times. Implementing a captcha on my end won't work and I have no control over blocking IP addresses.

[ Parent | on HN ]

Re:Ask HN: How do I stop card testing attacks on my Stripe a... by magundu on Monday April 24, 2023 @01:03AM (#35683843)

Now more people know how to do the card testing.

There must be an option to allow stripe script only in specific domains and sub domains. All other domains should be blocked.

[ Parent | on HN ]

Re:Ask HN: How do I stop card testing attacks on my Stripe a... by tehbeard on Monday April 24, 2023 @03:39AM (#35684722)

Doesn't work as that kind of info is in the http headers sent by the client..

[ Parent | on HN ]

Re:Ask HN: How do I stop card testing attacks on my Stripe a... by harg on Monday April 24, 2023 @05:11AM (#35685269)

Are you sure this is how it’s being done? My understanding of stripe checkout is that you need the secret key to create a checkout session.

[ Parent | on HN ]