Sure, but you can just compare the two sites' external measures of security, and they're not even close.
Stripe domains:
- Pass optional HTTP security headers (like X-Frame-Options on manage.stripe.com)
- Are pinned to Chrome's HSTS list (http://src.chromium.org/viewvc/chrome?view=rev&revision=...) and pass a Strict-Transport-Security header
I feel like Colin built this little thingy to solve a real problem --- that by adding Stripe to his site, he was giving Stripe control over his site, and his site hosts information more sensitive than credit cards --- and people are piling on because his solution to his little problem doesn't solve every other imaginable security problem.
This would be less galling if the kinds of sites using Stripe today weren't almost uniformly rife with application security flaws that defeat most of the good intentions that Stripe has.
Myself, I'd place a lot of trust on cperciva, the former FreeBSD security officer, a guy who has written papers on security flaws in Pentium 4 processors. (http://www.daemonology.net/hyperthreading-considered-harmful...)
[edit] paymentiframe.com's FAQ now includes this:
Why should I trust you with my credit card entry form?
You probably shouldn't. This is more of a proof of concept — but you might also want to use the CGI script to generate an iframe which you download (along with the bits it links to) and serve up as a static file from a server you run (but make sure you get a separate domain name for it).