Hacker News Reader

Since the page is loaded over plaintext, there's no easy way for a normal user to know that the credit card isn't being intercepted by a malicious script. It's not safe to serve a payment page over plaintext HTTP, even if it POSTs to a HTTPS endpoint as it could be modified in transit.

Stripe explains that TLS is required in their docs: https://stripe.com/help/ssl

View on HN

If you read a bit further, the Stripe documentation explains that it is recommended, but not required.

You can make live transactions just fine from a regular HTTP page - whether that's a good idea or not is another issue, but making Stripe payments from an HTTPS payment page is not required from an API point of view.

They explain use cases for testing without HTTPS, but make it clear that TLS is required for production use.

Required in the 'it's a good idea because it will make the web more secure and make your customers trust you' sense, not required in the sense that it's something the API enforces.

Reply on news.ycombinator.com