Good one if you'd never change your password. Say I generated a password for my HSBC account with this. Later, if they ask me to change the password, I'm out of options because it's one password per account.
Before posting this topic, I thought making CL social would make it better. Then, I watched a video documentary about CL on youtube, and I felt that being unsocial, and anonymous posts is what's propelling craigslist. So, you're probably right about doing nothing.
One Amazon EC2 'micro' instance when I launched http://www.nepaladz.com That too was running on a free server (for the first year). And it was delivering around 200k requests per day at around 40% server load. It is however configured to auto scale as per the load.
I've been sleeping around 4.5 hours in average since last few weeks, working on a tech startup idea. I think I should go for at least 6 hrs now. 8 hrs sounds more appropriate though.
You are fully responsible for the security of data on your website or otherwise in your possession. You agree to comply with all applicable state and federal laws and rules in connection with your collection, security and dissemination of any personal, financial, Card, or transaction information (defined as “Data”) on your website. You agree that at all times you shall be compliant with the Payment Card Industry Data Security Standards (PCI-DSS) and the Payment Application Data Security Standards (PA-DSS), as applicable. You agree to promptly provide us with documentation evidencing your compliance with PCI DSS and/or PA DSS if requested by us. You also agree that you will use only PCI compliant service providers in connection with the storage, or transmission of Card Data defined as a cardholder’s account number, expiration date, and CVV2. You must not store CVV2 data at any time. Information on the PCI DSS can be found on the PCI Council’s website. It is your responsibility to comply with these standards.
What this means is once you make a payment, you are at the mercy of the vendor you're making payment to. If the vendor does anything mischievous (which shouldn't be difficult at all), you're on your own. :)
Stripe maintains commercially reasonable administrative, technical and physical procedures to protect all the personal information regarding you and your customers that is stored in our servers from unauthorized access and accidental loss or modification. However, we cannot guarantee that unauthorized third parties will never be able to defeat those measures or use such personal information for improper purposes. You acknowledge that you provide this personal information regarding you and your customers at your own risk. We recommend you review our Privacy Policy, which will help you understand how we collect, use and safeguard the information you provide to us.
I think those who've received the certification are pretty much worth the trust. I don't see anything like that on stripe.com homepage though. Ditto for paymill.com.
Maybe what you're saying is the only way. Or maybe there are some options (two options in the above comment). But whatever it is, we cannot resort to an insecure way of payment just because there is no other way.
That seems like one good way of doing it. The other one I can think of is using a widget containing html form generated dynamically by stripe, along with a back link with a unique hash param that verifies it's authenticity.