The new ‘Pay with Stripe’ button makes online payments feel better

Re:The new ‘Pay with Stripe’ button makes online payments fe... by kennu on Tuesday October 09, 2012 @10:37PM (#4634813)

It's beautiful, but how does the user verify that the credit card popup form is being posted to a valid, secure site?

I mean, normally you'd first be redirected to a trusted payment site and verify its SSL identity in the browser URL bar. Then you'd know that the trusted site will do things properly from there.

But in this case, are you just supposed to trust blindly that the Stripe-looking payment form popping up on some semi-random site will really be submitted to Stripe? Am I missing something?

[ Parent | on HN ]

Re:The new ‘Pay with Stripe’ button makes online payments fe... by _pius on Tuesday October 09, 2012 @10:44PM (#4634823)

Am I missing something?

Yes: most customers don't think about the question you're posing.

For that question to even arise in a customer's mind, they would have to know what an iframe is. Otherwise, it's just a cool little popup that the website opened.

[ Parent | on HN ]

Re:The new ‘Pay with Stripe’ button makes online payments fe... by gailees on Tuesday October 09, 2012 @10:53PM (#4634845)

100%....Most customers don't even understand https vs http. In the tech bubble, we definitely recognize things like that, but for normal people, they determine their trust by the look and brand name on the payment form.

This button is the first step for stripe to start being a trusted name by more skeptical e-customers.

[ Parent | on HN ]

Re:The new ‘Pay with Stripe’ button makes online payments fe... by kennu on Tuesday October 09, 2012 @11:04PM (#4634866)

I would trust Stripe, but only after seeing it verified as the owner of the SSL certificate of the website I'm using. There's way too much phishing going on for me to trust anything just shown in HTML branding..

Of course I realize that 'normal' people might trust anything, but it still won't make me trust it any more. So I'm not quite sure in what situation I would personally ever be able to use these nice Stripe button payments.

[ Parent | on HN ]

Re:The new ‘Pay with Stripe’ button makes online payments fe... by frio on Wednesday October 10, 2012 @12:09AM (#4635009)

Surely that's a bad thing? It would be trivial to make an identical Javascript popup which harvested data rather than sending it off to Stripe. Yes, the current redirect-ad-infinitum workflow is reasonably trash, but this scares me a lot, and I'd personally not trust it.

[ Parent | on HN ]

Re:The new ‘Pay with Stripe’ button makes online payments fe... by greendestiny on Wednesday October 10, 2012 @01:05AM (#4635131)

I think the idea would be that this is in a https payment page of the client company who you would then choose to trust (or not) as implementing the payment frame correctly. Just like if they had their own payment solution essentially.

[ Parent | on HN ]

Re:The new ‘Pay with Stripe’ button makes online payments fe... by lucisferre on Tuesday October 09, 2012 @10:51PM (#4634841)

Besides how does a pop up make it more likely to be an iframe than just any old iframe?

[ Parent | on HN ]

Re:The new ‘Pay with Stripe’ button makes online payments fe... by k3n on Tuesday October 09, 2012 @11:12PM (#4634882)

Don't all modern browsers warn of (or block) mixed HTTP/HTTPS content?

[ Parent | on HN ]

Re:The new ‘Pay with Stripe’ button makes online payments fe... by brandon272 on Wednesday October 10, 2012 @12:05AM (#4635002)

Only if the parent page is HTTPS and tries to load HTTP content, but not vice versa. So an HTTP page loading an HTTPS iframe won't trigger an error.

[ Parent | on HN ]