Re:Braintree V.Zero SDK – Faster integration, drop-in UI, an...
by pbcoronel on Wednesday July 09, 2014 @04:21PM
(#8012036)
This is Pedro, one of the developers at Braintree who worked on this product. Security is our top priority which is why we will show a pop-up window hosted on a PayPal domain in the environments that support it. We are incrementally rolling this feature out. Here's more info about this particular issue: https://developers.braintreepayments.com/javascript+ruby/sdk...
[ Parent
| on HN ]
Re:Braintree V.Zero SDK – Faster integration, drop-in UI, an...
by talos on Wednesday July 09, 2014 @04:37PM
(#8012110)
Interesting. I understand that popups might not be supported in certain environments, but it would seem the preferable flow in that case would be to forward to Paypal, authorize, then forward back. I just don't see any way to protect a lightbox from phishing, even if that's only on a subset of devices.
I guess I'm not up on the limitations of mobile browsers, but if they really make it so hard to expose the URL, it would seem to re-open a huge array of phishing attacks (and, once these are heavily exploited, mobile browsers will probably get better about exposing URLs.)
Re:Braintree V.Zero SDK – Faster integration, drop-in UI, an...
by tokenizerrr on Wednesday July 09, 2014 @04:52PM
(#8012172)
The most interesting part to me is that this is a regression. Paypal integration used to work like you said, and like I said here[1], though now they seem to favor usability over security.