Interesting approach. On one hand, I like that it avoids the initial round-trip to a third party server. However I bet Stripe takes advantage of data that it's getting that Barintree may or may not be (or at least not reliably) such as IP address, useragent, cookies or really anything Stripe would want to bake into the JavaScript.
However I bet Stripe takes advantage of data that it's getting ... such as IP address, useragent, cookies or really anything Stripe would want to bake into the JavaScript.
They'd better not be. That would be a serious violation of the merchant's trust in incorporating external JS from Stripe, not to mention introducing privacy and data protection concerns that could be deal-breakers for even using Stripe at all.
With the recently announced UK beta, it would be reassuring to see someone from Stripe pop up here and categorically deny that they do (or ever will do) anything in their externally-supplied JS other than the tokenization that is why merchants load it.
Do cookies need to be explicitly referenced in code or do they just come along with the request? The cc processor is only interested in its own cookies, not the merchants'.
If Stripe doesn't someone will. It's too useful to go unused. The privacy concerns should be minimal. Basically, if I have a cookie that indicates I've done 10 previous good txns from tis device, you could pretty much do an 11th with little or no extra data. That's a huge win.
I don't care for your attempt to scare an entity away from doing something quite reasonable.
If Stripe doesn't someone will. It's too useful to go unused.
Tracking us all over the Internet is useful, if you're a spammer who wants to hassle everyone to buy their junk all the time. Most of us don't like spammers, either.
The privacy concerns should be minimal.
Please correct me if I'm misunderstanding you, but you appear to be advocating the collection of arbitrary information, via a third party script downloaded from an external source, in the middle of a payment process where sensitive credentials are in use, without necessarily giving notice to either the customer or the merchant about what is being done.
I normally prefer to make logical arguments and cite real data in this kind of discussion, but I genuinely don't know how to respond to the suggestion that this has minimal privacy concerns.
I don't care for your attempt to scare an entity away from doing something quite reasonable.
You and I have very different ideas of what "quite reasonable" means. Indeed, this "quite reasonable" behaviour seems to be illegal on several different grounds here in the UK, and as a merchant I would worry not only that I could not trust any third party service doing it to treat my customers well but also that they could get my own business caught up in at best dubiously legal activities without us even doing anything. That sort of ambiguity/distrust is toxic and grounds for staying far away from any such service.
Do you actually have any evidence that Stripe is in fact doing this kind of thing, or were you just stirring up trouble?
