Stories
Slash Boxes
Comments
typodupeerror delete not in
  • Preferences

Hot Comments

Comments: 128 +-   PayPal Introduces Open API on Wednesday November 04, @05:11PM

Posted by timothy on Wednesday November 04, @05:11PM
from the freedom-to-pay dept.
it
m2pc writes "PayPal has just announced the availability of their Open API under the 'PayPal X Program.' This enables developers to integrate PayPal payment processing services without forcing users to redirect to PayPal's website to enter payment information. This new initiative is designed to allow the company to better compete with the likes of Google and Amazon, which offer similar services. I wonder how much they paid for their domain: x.com?"
story

Related Stories

Submission: PayPal Introduces Open API by m2pc (546641)
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

PayPal Introduces Open API 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.
  • As a developer, I'm freakin excited. I hope it doesn't cost too much money.. or any at all. That's the reason I prefer Paypal for smaller projects over authorize.net.. save the monthly bills.

      • Re:As a Developer (Score:5, Informative)

        by nacturation (646836) * <nacturation@NOspAM.gmail.com> on Wednesday November 04, @07:39PM (#29988764) Journal

        Why on earth would I want to add the burden of handling and protecting sensitive financial information when I can just send the user to a website they are familiar with to complete the transaction? No credit card numbers in my DB to steal, added trust for the user - this API seems like fail-fail.

        If you're storing credit card numbers, you're doing it wrong. Here's how it should happen:

        • Your payment page is SSL secured and people enter their CC details
        • Your web server sends it through an SSL-secured API to PayPal
        • PayPal responds with the result
        • Your web server does or doesn't approve the order as appropriate (this is the ??? step)
        • Profit!

        The only storage of sensitive information that goes on is inside the server's RAM and it gets discarded from RAM once the transaction concludes.

  • API??? (Score:5, Insightful)

    by click2005 (921437) on Wednesday November 04, @05:14PM (#29986788)

    Another Price Increase

  • one-letter domain? (Score:2, Interesting)

    by Tolaris (31078)

    Since when are 1-letter second-level domains allowed? I thought it was limited to two letters and up.

  • Um...guys.... (Score:4, Interesting)

    by Itninja (937614) on Wednesday November 04, @05:16PM (#29986820) Homepage
    I was doing this on an ecommerce site I administered like four years ago. It was called PayPal Payments Pro (or some such) and cost $20/month. No redirects at all. Other than the new domain, what's new? Is it free now?

    • Ditto, I also have integrated with that service, so this seems like a non-story, maybe a different rate schedule if anything.

      "Website Payments Pro" https://www.paypal.com/uk/cgi-bin/webscr?cmd=_dcc_hub-outside [paypal.com]

    • Payflow Pro. I'm thinking the same thing. Maybe they're actually pointing more towards using a Paypal ID without leaving the site or something...I dunno, but I do know my company is one of the processors for Paypal and that they've had functionality like that for quite some time.

    • Re:Um...guys.... (Score:4, Interesting)

      by jjohn24680 (1050922) on Wednesday November 04, @06:13PM (#29987708)
      PayProFlow is their credit card payment gateway, and handles other kinds of related transactions (debit cards, pre-funded cards). It appears this API ties to their main payment system (transfer funds between PayPal accounts) rather than credit cards. The company I work for uses their gateways to process transactions for both credit cards and also payments between PayPal accounts. Currently, if someone wants to receive a payment from us, they have to go to the PayPal website and create an account there. Once they have an account, we can use the existing API to transfer funds. From the article, it appears that you can use this API to create a new account, which is something that I don't believe can be done at this point.

  • Paypal was originally x.com (Score:5, Informative)

    by SashaMan (263632) on Wednesday November 04, @05:19PM (#29986866)

    Paypal has owned the x.com domain since before they were paypal (check wikipedia), so while x.com probably wasn't super cheap back in 1999, it's not like they just purchased it.

    • Yeah, the offered online checking accounts. I signed up for X.com and Paypal accounts initially because they were giving away free money, no deposit required. I didn't think either one would last (I was half right), but hey, free money.

    • I still have my old x.com credit card. It's a great geeky X-Com commemorative, even though it has nothing to do with the game. :-D

    • Years ago, I used to go to paypal by going to x.com. It was so much shorted to type and it just redirected for me to paypal.com Then they made it the "labs" site and my shortcut was ruined.

    • Re:Paypal was originally x.com (Score:4, Interesting)

      by loshwomp (468955) on Thursday November 05, @01:45AM (#29991708)

      X.com was one of the companies that merged to form PayPal. They epitomized the bubble "land grab" mentality by giving away free money to attract customers.

      I still have a check for $0.01 sent to me (for no obvious reason) by "PayPal's X.com" during the bubble days. It's such a perfect metaphor for the stupidity of that era that I just had to save it and frame it.

  • I wonder what PCI implications this will have. (Score:3, Insightful)

    by marbike (35297) * on Wednesday November 04, @05:30PM (#29986992) Homepage

    A lot of companies expend a great deal of resources in order to conform to PCI-DSS. The need for extensive testing, Web App Firewalls and the like is a pricey and time consuming activities for merchants dealing with PCI. When seasoned developers often forget to mask PANs, I wonder what the novice developer will do. I hope that this service will include some PCI guidelines so small merchants won't get bit in the ass by the certification bug.

  • redirect is better (Score:5, Insightful)

    by bolthole (122186) on Wednesday November 04, @05:32PM (#29987024) Journal

    I personally LIKE the redirect. I LIKE only inputting my credit card/whatnot information to paypal.com directly, instead of some random site that I'm doing a one-time transaction with and will probably never see again.

    • Re:redirect is better (Score:5, Insightful)

      by webheaded (997188) on Wednesday November 04, @05:45PM (#29987220) Homepage
      Yeah, I'd have to agree. I generally shy away from websites that directly ask me for a username and password for another site. I don't care who you are, but after all the phishing emails and such we've seen over the years, you'd have to be pretty dense to not feel at least a little uncomfortable with something like this.

      • there is a solution (Score:4, Funny)

        by commodoresloat (172735) * on Wednesday November 04, @07:53PM (#29988946)

        We have a site that can ease your mind about such transactions, and we can even alert you to suspicious activity! Kindly provide the following information and our salespeople will get you set up:

        Name:
        Paypal Username:
        Paypal Password:
        Social Security Number:

    • Re: (Score:2, Informative)

      by Anonymous Coward

      Sort of off topic, but something that might interest you if you haven't seen it before is a feature Citi offers with their credit cards called virtual account numbers [citicards.com]. Basically, it allows you to generate different numbers that point back to your real account and are only good for one use. You can also limit the amount of time they're active as well as put a cap on how much money can be drawn from it. Pretty cool.

    • Re: (Score:2, Insightful)

      by amasiancrasian (1132031)

      +1 post; allowing website owners to directly process user/pass info for PayPal is potentially a dangerous move if all sorts of security audits/nefarious site owners are processing login info. There's definitely potential for abuse because the redirect kept the user/pass separate from the app processing. We implemented SSO handling via CAS because we could train users never to type in their user/pass on any site except for sso.bigcompany.com.

      Further, even banks require all sorts of audits if a website is han

      • Re:redirect is better (Score:4, Insightful)

        by tlhIngan (30335) <(slashdot) (at) (worf.net)> on Wednesday November 04, @06:18PM (#29987768)

        Not to mention, there'll be a whole host of XSS crap going on so that sites can grab your login information to Paypal from their website. After all, their site has to include the paypal stuff in it, who's to say that "submit" button isn't "send us and paypal your login"?

        If using Paypal, I expect to visit Paypal's site to log in. (There were some XSS used to get the site's inventory into Paypal, but that's a different issue, and it happens before login).

        My Paypal information is valuable - I don't want to trust some oddball website with it. I hope there's a "Redirect to Paypal" link I can use instead of this stuff...

    • Totally agree with you here. It felt weirder ordering off Dell.com than it did DealExtreme.com. I was expecting redirects to a secure site for payment.

    • Re:redirect is better (Score:4, Insightful)

      by DigitalCrackPipe (626884) on Wednesday November 04, @06:15PM (#29987742)
      I hope they continue to allow the explicit paypal.com visit. Otherwise I forsee bailing out of a number of transactions due to the sketchiness of giving free access to your bank account to some random site.

  • Bummer! (Score:5, Insightful)

    by timeOday (582209) on Wednesday November 04, @05:33PM (#29987026)
    As an end user, to me the value in going through a centralized payment service is the security of having only one reputable company (PayPal) handling my personal information, instead of having every vendor out there from whom I've ever bought anything potentially putting my CC# into their database. Forget disintermediation via this API, I'd rather go the other way and have assurance from the middleman that the vendor will never get anything they don't need for order fullfillment - that is, just my name and mailing address.

  • x.com (Score:2, Informative)

    by JoeF (6782)

    They didn't pay anything for x.com. They were x.com originally.

  • Security? (Score:4, Insightful)

    by Manip (656104) on Wednesday November 04, @05:51PM (#29987322)

    This is sad news for me personally.

    I always liked that I got redirected to PayPal.com to enter my PayPal details. Allowing me to check the SSL certificate and avoiding certain kinds of phishing fraud. Plus keeping my login details out of the hands of third parties who might enjoy looking at my payment history (which I agreed to in line 9999 subsection 5, amendment 3 of the T&C).

    Ironically while PayPal moves away from a redirection systems the big credit card companies (VISA, Mastercard, etc) are moving into one. Now often bringing up a password page operated by your CC company in order to verify that you haven't stolen card details.

    • Re: (Score:2)

      by Kenja (541830)
      If it ties in to the rotating cipher device PayPal offers its all the same to me. Its a DigiPass Go 3 FYI, similar to what Blizzard uses for WoW.

  • It'll be a cold day in hell before they see any utilization by any of the companies I work for or service.

    They could be the last financial institution on the planet. I and some of the people I work for would revert to a barter economy first.

  • No parking. (Score:4, Funny)

    by Snufu (1049644) on Wednesday November 04, @05:56PM (#29987430)

    I wonder how much they paid for their domain: x.com?

    It's variable.

  • This is a bad idea because... (Score:5, Insightful)

    by phiz187 (533366) on Wednesday November 04, @05:57PM (#29987440) Homepage Journal
    This is going to make users accustomed to entering their paypal credentials into all sorts of unique interfaces, on a variety of websites. It is going to condition users to be less guarded about their paypal credentials. As it stands now, you basically only enter your PayPal credentials into either the PayPal.com or Ebay.com domains. Users know that if anywhere else asks for their credentials, that it is a phishing site. I think this is going to be a minor disaster for PayPal. But hey, maybe they're cash-flush enough to eat the cost of all the new fraud claims that are going to result.

    • Re: (Score:3, Informative)

      by gravyface (592485)
      I have a newsflash for you Walter Cronkite: users wouldn't know the difference between ebay.com and ebay.ha.ha.pwned.com if it had an eBay logo on it.

  • Nifty, but I'm waiting for the day that they announce good customer service.

    (Although I believe they're lifting the ban on adult content sites, so that's good.)

  • thanks sirs - exciting news (Score:3, Funny)

    by postmortem (906676) on Wednesday November 04, @07:22PM (#29988564) Journal

    Dear Sirs,

    These are great news that promise increased effectiveness and efficiency in money transfers for humble users from Nigeria.

    Additionally, if you could assist me in transferring some funds from our deceased noblemen, you will truly be awarded.

    Yours Faithfully,

    Dr. Akeem Biobaku

Search
One person's error is another person's data.

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2010 Geeknet, Inc.