zlacker

>>mtlync+(OP)
This is a good reason to use a technique like cperciva's payment iframe: https://www.paymentiframe.com/

It lets you use stripe.js (thus getting the PCI compliance benefits) without Stripe being able to spy on your visitors.

>>agwa+tg
While I trust him, how can we be sure that paymentiframe.com starts serving an iframe that steals the credit cards in the future?

>>Znafon+Ao
From the page:

> Why should I trust you?

> [...] If you're worried about both, consider this a proof-of-concept which you should replicate on your own server (using a separate domain name from the rest of your site).