"Your payment information is never transmitted to BGA"

[jhnc]

I'm want to subscribe but don't understand this message:

Your payment information is never transmitted to BGA

All I see is a box that pops up onscreen asking for my credit card details. Naively inspecting the page source, there is a form but it has no obvious associated "post" action. Perhaps this is hooked by stripe (given that the box doesn't fill properly if I disable loading javascript from stripe.com) but it is not at all obvious to me.

How do I confirm, before I enter my credit card details, that I am actually sending my data directly to the payment processor's website?

[sourisdudesert]

Hi

Your payment information is "tokenized", and thus all what BGA is seing is a "payment token" without your payment informations.

As a result, we don't store your payment information, event in our technical logs. Thus, if Board Game Arena is hacked, the attackers won't be able to get your Credit Card number.

Technical details here:
https://stripe.com/docs/api/tokens

Greg

[jhnc]

Okay, perusing that link, it seems that what I hadn't noticed is that the entry fields in the popup are actually iframes masquerading as form input elements. And the iframes are from the js.stripe.com domain. All that convolution leaves me still hesitant to enter my details but I expect I am in the minority.

Your paypal interface is easier to trust (it is clear from the browser address bar that it is a paypal page). Although I dislike paypal itself... (I'd put an emoji here but the smilies hover text is in French(?) so I don't know what they are supposed to mean!)

Thanks for getting back to me. Great work on the server, much appreciated.