Hacker News new | past | comments | ask | show | jobs | submit login

I'm not convinced using Stripe or similar services gets you out of PCI compliance.

The vast majority of PCI compliance requirements - those relating to server security - would seem to still apply. If someone hacks your server, they could easily add an additional bit of JavaScript that sends the CC field to a second, malicious server.




That's a worst case scenario and things could be worse if they hacked your production code base.

All data should be 256bit ssl encrypted for point to point security and asset tampering protection. After that, i doubt stripes js lib is much of a problem, it communicates in a secure tunnel from the client to stripe.

They as well say you don't have to worry about PCI compliance then because you are never handling financially sensitive data directly, only indirectly.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: