Slashdot Mirror
PayPal Introduces Open API
m2pc writes "PayPal has just announced the availability of their Open API under the 'PayPal X Program.' This enables developers to integrate PayPal payment processing services without forcing users to redirect to PayPal's website to enter payment information. This new initiative is designed to allow the company to better compete with the likes of Google and Amazon, which offer similar services. I wonder how much they paid for their domain: x.com?"
As a developer, I'm freakin excited. I hope it doesn't cost too much money.. or any at all. That's the reason I prefer Paypal for smaller projects over authorize.net.. save the monthly bills.
Belief? Hope? Preference?The Existential Vortex
Another Price Increase
I am a free slashdotter. I will not be modded, blogged, DRM'd, patented, podcasted or RFID'd. My life is my own.
Since when are 1-letter second-level domains allowed? I thought it was limited to two letters and up.
I was doing this on an ecommerce site I administered like four years ago. It was called PayPal Payments Pro (or some such) and cost $20/month. No redirects at all. Other than the new domain, what's new? Is it free now?
I judt got a nre Kinesis keybiartf so please excusr ant egregiou typos.
Paypal bought x.com a number of years ago. 8 years? Something like that. I think it happened when they were still giving you $5 for every new referral you brought in (I made some $$$$ off of Paypal, now it's the other way around. :( ).
Paypal has owned the x.com domain since before they were paypal (check wikipedia), so while x.com probably wasn't super cheap back in 1999, it's not like they just purchased it.
A lot of companies expend a great deal of resources in order to conform to PCI-DSS. The need for extensive testing, Web App Firewalls and the like is a pricey and time consuming activities for merchants dealing with PCI. When seasoned developers often forget to mask PANs, I wonder what the novice developer will do. I hope that this service will include some PCI guidelines so small merchants won't get bit in the ass by the certification bug.
it is better to light a flame thrower than curse the darkness. -Terry Pratchett Men at Arms
I personally LIKE the redirect. I LIKE only inputting my credit card/whatnot information to paypal.com directly, instead of some random site that I'm doing a one-time transaction with and will probably never see again.
As an end user, to me the value in going through a centralized payment service is the security of having only one reputable company (PayPal) handling my personal information, instead of having every vendor out there from whom I've ever bought anything potentially putting my CC# into their database. Forget disintermediation via this API, I'd rather go the other way and have assurance from the middleman that the vendor will never get anything they don't need for order fullfillment - that is, just my name and mailing address.
They didn't pay anything for x.com. They were x.com originally.
This is sad news for me personally.
I always liked that I got redirected to PayPal.com to enter my PayPal details. Allowing me to check the SSL certificate and avoiding certain kinds of phishing fraud. Plus keeping my login details out of the hands of third parties who might enjoy looking at my payment history (which I agreed to in line 9999 subsection 5, amendment 3 of the T&C).
Ironically while PayPal moves away from a redirection systems the big credit card companies (VISA, Mastercard, etc) are moving into one. Now often bringing up a password page operated by your CC company in order to verify that you haven't stolen card details.
It'll be a cold day in hell before they see any utilization by any of the companies I work for or service.
They could be the last financial institution on the planet. I and some of the people I work for would revert to a barter economy first.
Chas - The one, the only.
THANK GOD!!!
I wonder how much they paid for their domain: x.com?
It's variable.
This is going to make users accustomed to entering their paypal credentials into all sorts of unique interfaces, on a variety of websites. It is going to condition users to be less guarded about their paypal credentials. As it stands now, you basically only enter your PayPal credentials into either the PayPal.com or Ebay.com domains. Users know that if anywhere else asks for their credentials, that it is a phishing site. I think this is going to be a minor disaster for PayPal. But hey, maybe they're cash-flush enough to eat the cost of all the new fraud claims that are going to result.
Pretend I said something meaningful or insightful here.
Well, if the submitter did any background work before furiously cutting and pasting from someone's blog to get this submission, they'd realize that x.com is actually paypal's ORIGINAL domain name before they got bought and turned into paypal. But hey, who expects facts in a slashdot submission?
Nifty, but I'm waiting for the day that they announce good customer service.
(Although I believe they're lifting the ban on adult content sites, so that's good.)
I wonder how much they paid for their domain: x.com?"
.
I wonder if PayPal is ever going to provide anything better than barely mediocre customer service?
He meant greedy business entity strongly financially motivated to avoid any uncontrolled release of your information.
PayPal very diligently acts to protect their bottom line. You may not like their policies on withholding balances, but that same financial diligence also goes in to maintaining security to prevent the huge financial losses that would occur should the public no longer perceive paypal as secure.
paintball
Don't you remember that X.com *WAS* PayPal until about 2000? I would be surprised if they paid more than a four-figure sum for the domain; real estate wasn't as valuable back then. X.com was originally an online bank of sorts.
Where is the whatcouldpossiblygoeswrong tag ?
I have spent the better part of my digital life convincing people that Paypal credentials should ONLY be provided when on Paypal.com, when you have a nice SSL certificate showing Paypal, Inc. and the like.
Granted you could place your credentials on retailer sites through existing APIs but most retailers recognized the need for consistency and helped condition Paypal users to expect to be taken to Paypal.com to complete the transaction and then back to the retailer site.
I agree, the chances of phishing success just went up considerably with this decision and more likely than not, it will be affected normal everyday users of Paypal more than the new users.
Dear Sirs,
These are great news that promise increased effectiveness and efficiency in money transfers for humble users from Nigeria.
Additionally, if you could assist me in transferring some funds from our deceased noblemen, you will truly be awarded.
Yours Faithfully,
Dr. Akeem Biobaku
The new PayPal APIs allow developers to engage customers directly within their own applications rather than forcing them to port users off to the actual PayPal site. Users who don't even use PayPal can actually sign up for PayPal within the third-party application and begin making PayPal payments seamlessly from within the third-party application.
So now you're relying on a third party application running on your vendor's website to not secretly cubbyhole a copy of your PayPal password as you use the third-party site to login or register for PP ?
We have a site that can ease your mind about such transactions, and we can even alert you to suspicious activity! Kindly provide the following information and our salespeople will get you set up:
Name:
Paypal Username:
Paypal Password:
Social Security Number:
Hey, whatever gets us more page views.
(If you haven't been to http://x.org/ , you might not get the joke.)
~ C.
Hasn't PayPal always owned x.com? if I recall, you used to access the website at paypal.x.com and it wasn't until a few years ago that they started using paypal.com.
PayPal calls this WebSite Payments Pro. They don't use the world "Open", at least not to developers.
What they are offering is essentially the same thing banks offer as "merchant accounts" that connect to "shopping cart" programs. But, this being PayPal, without all the consumer protections that banks are required to provide. I've been reading through the documentation, and there's no sign of all the security requirements Visa imposes on merchants.
(Well, actually there is - under "Legal Agreements, Exhibit A". But there's no sign of technical requirements to back them up.)
Opera brings you to Slashdot if you simply type /. in the address window.
Try it!
Do what thou wilt shall be the whole of the Law
Other services, like moneybookers, have had public APIs for years. IIRC the moneybooker's one has been around since 2004. There are even development accounts that can be set up for testing and several levels of detail or complexity.
I'm not sure what the slashdot editors' fascination with paypal is about. A quota to peddle 'news' about M$ partners?
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
I hate posting 2 line messages but if you look at http://www.phishtank.com/ which the data is community provided/validated and open, I have real bad feelings about the upcoming API. Hopefully they don't trust the general public to know what an API is while they keep clicking the links on spam mails they get.
There seems to be a contradiction in PayPal's descriptions of the program. On the main summary page they say of Express Checkout, "Your customer chooses to pay with PayPal by entering their email address and PayPal password, without leaving your website." However, in the section on Express Checkout all the flow diagrams show the customer clicking on a button which redirects them to the PayPal website, where they enter their login and password, as is currently the case.
I'm inclined to believe that the current situation, with PayPal handling the authentication, is what they intended, and that the sentence on their summary page was a mistake. I'm certainly not going to enter my PayPal password on some random third-party website.
Their "Direct Payment" API, on the other hand, is completely transparent; the customer enters their CC data into the seller's website and never sees PayPal.
"The state is that great fiction by which everyone tries to live at the expense of everyone else." - Bastiat
x.com was a crazy bank in 2001, I used it a lot, and yes it was run by PayPal. Why was it crazy? Because it allowed me to take money from my credit cards and deposit them to a bank account using the web. I could then pull cash out at an ATM, write a check to another credit card company. It really saved me a few times, but in the end it only lasted about 6 months before PayPal really took off and they cut back the wacky services eventually the service altogether. Yeah, I had an x.com ATM card.
I always thought that you could accept credit cards on your own website without redirecting to PayPal. I believe it is called Website Payments Pro. "Process credit cards directly on your website with Website Payments Pro, our merchant account and gateway in one." What is exactly more integrated? Has anyone bothered to look at the "How It Works" link on the PayPal website? It doesn't show any redirection to PayPal.
Whois Server Version 2.0 Domain names in the .com and .net domains can now be registered
with many different competing registrars. Go to http://www.internic.net/
for detailed information.
Domain Name: X.COM
Registrar: MARKMONITOR INC.
Whois Server: whois.markmonitor.com
Referral URL: http://www.markmonitor.com/
Name Server: PPNS1.DEN.PAYPAL.COM
Name Server: PPNS1.PHX.PAYPAL.COM
Name Server: PPNS2.DEN.PAYPAL.COM
Name Server: PPNS2.PHX.PAYPAL.COM
Status: clientDeleteProhibited
Status: clientTransferProhibited
Status: clientUpdateProhibited
Updated Date: 01-sep-2008
Creation Date: 02-apr-1993
Expiration Date: 20-oct-2011
>>> Last update of whois database: Fri, 06 Nov 2009 02:03:44 UTC http://www.markmonitor.com/
Administrative Contact:
Domain Administrator
eBay Inc.
2145 Hamilton Avenue
San Jose CA 95125
US
hostmaster@ebay.com +1.4083767400 Fax: +1.4083767514
Technical Contact, Zone Contact:
Domain Administrator
eBay Inc.
2145 Hamilton Avenue
San Jose CA 95125
US
hostmaster@ebay.com +1.4083767400 Fax: +1.4083767514
Created on..............: 1993-04-01.
Expires on..............: 2011-10-20.
Record last updated on..: 2009-07-25.
Domain servers in listed order:
ppns1.phx.paypal.com
ppns2.den.paypal.com
ppns2.phx.paypal.com
ppns1.den.paypal.com
I'd like to buy homeland for our 10 million people. http://twitter.com/mahadiga
As mentioned in several posts before this one, I prefer to be redirected to PayPal's own website, and being asked to confirm my UID and password there. The whole idea behind PayPal was always anonymity when making payments online. The website you were purchasing from never had a chance to get your payment information. Being redirected to PayPal to make such an 'anonymous' payment to any website, made transactions safe and secure ( with any legitimate website, anyway ), and it also let me double check that I was indeed being redirected to PayPal, and not to some web page in Nigeria. . With this API, I don't think that I can never be sure of that. Too much is happening behind the scene. I would be entering my payment info into the web server of company xyz. In fact, alot of different company xyz's, throughout the year. Are each of these companies promising me that they aren't keeping my payment info ? Is my payment info being automatically and silently backed up into a dozen places on the operating system ? Histories ? Web Logs ? Is company xyz promising me that their system is well maintained, locked down, and they can safeguard the information that I have entered into their web page ? Will there never be any scripts on their web server that can capture my information and send it to Nigeria ? I don't think so. I don't see why PayPal is moving away from the security model that sold so many of us into using their service to begin with. And, just for PayPal's information, I don't like the new idea. I guess that all I can hope for is that PayPal insists that all of their clients include a link for me to go to the PayPal webpage to complete a transaction, just the way it has been for years now. And put that link somewhere close by this new API gizmo of theirs..
If it has tires or tits, it will give you problems.