Hacker News new | ask | show | jobs
by delinka 5164 days ago
The Stripe JavaScript will submit your details over HTTPS. To prevent this very concern (the perception that submitted data will not be secured), sites should serve their forms over HTTPS as well.
4 comments

Unless someone substituted the javascript served by the page over unprotected HTTP (while it was sent to you). Firesheep already showed that making similar process user-friendly isn't that hard.
Having pre-submission pages (or anything leading to the submission of sensitive data) not be over HTTPS is more than just an issue of perception; for example, a network attacker can inject javascript into the unsecure form page and read/send off the credit card details before the form is even submitted.
Since more than one of the replies I me mention this, I'll reply to myself...

It is correct that serving the necessary JavaScript over HTTPS is the Right Thing To Do as it prevents injection. IIRC (I'm on my phone and not where I can research) Stripe serves the JavaScript themselves over HTTPS (you pull their scripts from their server) and this problem is solved.

While I understated the concern about serving forms unsecured, the same MITM problem is a potential issue for the page containing the form. The solution is the same: serve over HTTPS.

HTTPS or not, Stripe accepting credit card data on a site they don't control is extremely worrying.