Hacker News Reader

One of the big recent changes I'm aware of is that users can now host their own page and merely post to a payment service, without being PCI compliant. Before the payment service had to host the page, which meant an iframe or a PayPal style redirect.

View on HN

That's a technique that Braintree has popularized if not pioneered, but it's a neat trick that most people agree is PCI compliant (I also hope and believe this), not a change in the security standards.

Among others, USAePay has also made this possible for some years (not as well as braintree does), and the payment startup stripe http://stripe.com/ achieves the same result in a more JavaScript-y way.

It is getting more popular, though, I suppose.

Reply on news.ycombinator.com