2

The Stripe Checkout overlay (https://stripe.com/checkout) pops up within a site and does not show the associated URL. A malicious website could create its own overlay that looks like Stripe's, and trick users into thinking that they are giving their credit card info to Stripe.com

Is it possible that Stripe is doing something to prevent this? Or is it just not enough of a concern for them?

2 Answers 2

2

Stripe's Checkout overlay doesn't help prevent phishing, but the preferred alternative (iframes) doesn't either, so it's a wash in terms of phishing security.

PCI DSS emphasizes the steps required to secure the server which is providing the overall page to the customer, which in turn should help ensure the validity of the (iframe, javascript, links). If the merchant's web server gets kicked over, those can all be redirected to a malicious third party, so preventing that is the focus.

Things tend to work out like this:

  1. Outsourcing card data entry to the Processor reduces Merchant scope and improves overall Security
  2. Merchants prefer checkout to be seamless; the customer should not be aware of #1 unless they really want to know.
  3. iframe and javascript can be seamless, but by the same token remove phishing indicators from the process.

In the end, #1 and #2 outweigh the negatives of #3 given the lack of PCI DSS anti-phishing concern.

0

What you have to realize is that if the malicious actor owns the website, they can make the website display however they see fit, including a "source URL" if Stripe had decided to include one. Similarly, I could make a website that looks exactly like google.com and forward all the search requests to Google so that I could:

a) Harvest users' search terms, along with their IP addresses, browser fingerprints, etc., and
b) Produce an actual Google search page, so the users think that nothing is amiss

In both cases, Stripe and Google are not able to prevent me from making a web server I control look exactly like their products, other than to possibly file DMCA violation requests with my hosting provider, although I doubt a criminal is really going to care, and will just move on to another hosting provider if that happened.

So to answer your questions:

Is it possible that Stripe is doing something to prevent this?

Probably not, although someone from Stripe would be the only one able to answer for sure.

Or is it just not enough of a concern for them?

I'm sure they are concerned about it, but there is little they would be able to aside from the previously mentioned copyright/trandmark claims they could make against a malicious site using their brand logos.

2
  • How do you mean that a malicious site owner can make their own site display a "source URL"? The address bar cannot be faked like that. Commented Nov 10, 2015 at 10:10
  • @SilverlightFox my impression was that the OP was asking along the lines of "why doesn't Stipe put the source URL in the modal with the payment form?", hence my explanation. If we are talking about the omnibox, then no it cannot be faked per se, but the malicious user could buy up domains that look similar to stripe.com, especially with the advent of IDNs. Many unsophisticated users will still fall for those tricks.
    – Craine
    Commented Nov 10, 2015 at 16:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .