Hacker News Reader

Comment by NightlyDev | Hacker News Reader

It's not like you're storing card data because you're using Stripe. Stripe also allows 3D Secure to be used, so Stripe is clearly the more secure option compared to PayPal.

View on HN

All Stripe checkouts that I have seen so far are embedded into seller's website. I do not care where the form submits to or how does backend looks -- as long as address bar shows merchant's website address, the form could be fake or scrapped via evil javascript. This makes Stripe significantly less secure than Paypal.

(I've heard that Stripe can do checkouts on it's own domain, but I haven't seen it on a real website)

And as for 3D Secure -- it has no benefit for customer, just an extra password to remember. I am not sure why banks waste time implemeting it, when other systems (like real-time notification of charges on my cell phone) would be significantly more useful.

A good implementation helps with leaked credit card information if every transaction would use 3D Secure. I dont need to remember an extra password for my bank (n26). I have to login to the app on my mobile and sinply allow the transaction by a tap. Easy as that, much more secure. I was impressed when i saw itctge first time.

One of the reasons that merchants do not enable 3DS for all transactions is that it hurts conversion. However, from September 14, nearly all online transactions in the EU will need to be authenticated by 3DS (2.0). 3DS 2.0 is supposed to be a much smoother experience, thereby reducing the negative effect that it has on conversion.

Outside the US you can't assume that every customer actually has a credit card. Using it as the only payment method would probably halve our sales here in europe. The beauty of Paypal is that it allows to add your bank account as a source of funds using it as instant payment method where otherwise a SEPA transfer (and 1-2 days of delay) would be the only popular alternative to a credit card.

Reply on news.ycombinator.com