Stripe records user movements on its customers' websites

This is a good reason to use a technique like cperciva's payment iframe: https://www.paymentiframe.com/

It lets you use stripe.js (thus getting the PCI compliance benefits) without Stripe being able to spy on your visitors.

While I trust him, how can we be sure that paymentiframe.com starts serving an iframe that steals the credit cards in the future?

From the page:

> Why should I trust you?

> [...] If you're worried about both, consider this a proof-of-concept which you should replicate on your own server (using a separate domain name from the rest of your site).

That is so ridiculously insecure I'm surprised the author has published it without a massive disclaimer.

Do NOT use an unknown third-party, without PCI qualification, to whom you have no contractual relationship, in between you and your payment provider.

It says at both the top and bottom of the page not to trust him, and at the bottom it says to implement it yourself if you care about security.

Seems fairly "disclaimed" to me.

Yeah nobody should be embedding this verbatim to process payments that will fail any pci audit.