Slashdot Mirror
PayPal Introduces Open API
m2pc writes "PayPal has just announced the availability of their Open API under the 'PayPal X Program.' This enables developers to integrate PayPal payment processing services without forcing users to redirect to PayPal's website to enter payment information. This new initiative is designed to allow the company to better compete with the likes of Google and Amazon, which offer similar services. I wonder how much they paid for their domain: x.com?"
Another Price Increase
I am a free slashdotter. I will not be modded, blogged, DRM'd, patented, podcasted or RFID'd. My life is my own.
Since when are 1-letter second-level domains allowed? I thought it was limited to two letters and up.
I was doing this on an ecommerce site I administered like four years ago. It was called PayPal Payments Pro (or some such) and cost $20/month. No redirects at all. Other than the new domain, what's new? Is it free now?
I judt got a nre Kinesis keybiartf so please excusr ant egregiou typos.
Paypal has owned the x.com domain since before they were paypal (check wikipedia), so while x.com probably wasn't super cheap back in 1999, it's not like they just purchased it.
A lot of companies expend a great deal of resources in order to conform to PCI-DSS. The need for extensive testing, Web App Firewalls and the like is a pricey and time consuming activities for merchants dealing with PCI. When seasoned developers often forget to mask PANs, I wonder what the novice developer will do. I hope that this service will include some PCI guidelines so small merchants won't get bit in the ass by the certification bug.
it is better to light a flame thrower than curse the darkness. -Terry Pratchett Men at Arms
I personally LIKE the redirect. I LIKE only inputting my credit card/whatnot information to paypal.com directly, instead of some random site that I'm doing a one-time transaction with and will probably never see again.
As an end user, to me the value in going through a centralized payment service is the security of having only one reputable company (PayPal) handling my personal information, instead of having every vendor out there from whom I've ever bought anything potentially putting my CC# into their database. Forget disintermediation via this API, I'd rather go the other way and have assurance from the middleman that the vendor will never get anything they don't need for order fullfillment - that is, just my name and mailing address.
They didn't pay anything for x.com. They were x.com originally.
This is sad news for me personally.
I always liked that I got redirected to PayPal.com to enter my PayPal details. Allowing me to check the SSL certificate and avoiding certain kinds of phishing fraud. Plus keeping my login details out of the hands of third parties who might enjoy looking at my payment history (which I agreed to in line 9999 subsection 5, amendment 3 of the T&C).
Ironically while PayPal moves away from a redirection systems the big credit card companies (VISA, Mastercard, etc) are moving into one. Now often bringing up a password page operated by your CC company in order to verify that you haven't stolen card details.
I wonder how much they paid for their domain: x.com?
It's variable.
This is going to make users accustomed to entering their paypal credentials into all sorts of unique interfaces, on a variety of websites. It is going to condition users to be less guarded about their paypal credentials. As it stands now, you basically only enter your PayPal credentials into either the PayPal.com or Ebay.com domains. Users know that if anywhere else asks for their credentials, that it is a phishing site. I think this is going to be a minor disaster for PayPal. But hey, maybe they're cash-flush enough to eat the cost of all the new fraud claims that are going to result.
Pretend I said something meaningful or insightful here.
He meant greedy business entity strongly financially motivated to avoid any uncontrolled release of your information.
PayPal very diligently acts to protect their bottom line. You may not like their policies on withholding balances, but that same financial diligence also goes in to maintaining security to prevent the huge financial losses that would occur should the public no longer perceive paypal as secure.
paintball
In Canada there is Interac where you can send money by email - I assume there is something similar in the US. An Interac transfer is as good as a wire transfer - i.e. when the money gets to your account it is yours period. There is also HyperWallet which is popular with the credit unions and some other institutions.
The tyrant will always find a pretext for his tyranny - Aesop
I have spent the better part of my digital life convincing people that Paypal credentials should ONLY be provided when on Paypal.com, when you have a nice SSL certificate showing Paypal, Inc. and the like.
Granted you could place your credentials on retailer sites through existing APIs but most retailers recognized the need for consistency and helped condition Paypal users to expect to be taken to Paypal.com to complete the transaction and then back to the retailer site.
I agree, the chances of phishing success just went up considerably with this decision and more likely than not, it will be affected normal everyday users of Paypal more than the new users.
Dear Sirs,
These are great news that promise increased effectiveness and efficiency in money transfers for humble users from Nigeria.
Additionally, if you could assist me in transferring some funds from our deceased noblemen, you will truly be awarded.
Yours Faithfully,
Dr. Akeem Biobaku
Why on earth would I want to add the burden of handling and protecting sensitive financial information when I can just send the user to a website they are familiar with to complete the transaction? No credit card numbers in my DB to steal, added trust for the user - this API seems like fail-fail.
If you're storing credit card numbers, you're doing it wrong. Here's how it should happen:
The only storage of sensitive information that goes on is inside the server's RAM and it gets discarded from RAM once the transaction concludes.
Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
The new PayPal APIs allow developers to engage customers directly within their own applications rather than forcing them to port users off to the actual PayPal site. Users who don't even use PayPal can actually sign up for PayPal within the third-party application and begin making PayPal payments seamlessly from within the third-party application.
So now you're relying on a third party application running on your vendor's website to not secretly cubbyhole a copy of your PayPal password as you use the third-party site to login or register for PP ?
We have a site that can ease your mind about such transactions, and we can even alert you to suspicious activity! Kindly provide the following information and our salespeople will get you set up:
Name:
Paypal Username:
Paypal Password:
Social Security Number:
The problem here is if I'm not redirected to PayPal, I'm offering up my palpal authentication information to a third party in the hope that they're going to use it for the transaction I've authorized and nothing else.
Jherico
What can the average user can do to ensure his security? "Nothing, you're screwed"