Actinic Payments Integration

[RuralWeb]

card details directly into the Actinic checkout pages

This will be solved when/if Actinic allow the customisation of the payment page - again all discussed before.

[cbarling]

The Actinic Payments payment page can already be customised. It's just a bit fiddly and the style-sheet and any images must be stored on a server with an SSL certificate to avoid security warnings.

At least one of the pilot customers have already done this, I believe.

We are looking at simplifying this along with other possible improvements as a phase 2 development.

Chris

[Ginnys Attic]

I just feel that there is a better way of integrating Actinic Payments with Actinic Shops, can the card payment section not be called in from the secure Actinic server but displayed within the Actinic site somehow? Worst case surely a small 600x220 window is all that is required such as a pop-up/floating window or something for customers to enter there card details something like this is essentially all that is required:



Everything else about the current payments page is just unnecessary and potentially confusing/sale loosing fluff and I think it would just be simpler and easier to understand for the customers but not least it would be a far slicker integration with an Actinic shop. The window can still come off the Secure Actinic servers so no additional security issues, the layout could still be modified, we would loose the bounce pages and loose additional clicks and needless page and repeated details (such as name/address etc on the payment page) pages.

[outdooraction]

Very true it will take time and I’m sure over time it will improve. The intention of my post was to simply bring to Actinic's attention potential ideas for improvements that could possibly be made and for them to aim to be a solution for Actinic shops and not be just an alternative PSP.

The whole pre-authorisation, charging for goods etc from within Actinic is exactly what we would want, everything is other than the additional pages and clicking of next buttons, bounce pages and the horrible Actinic Payments page and of me all 3 of these things could quite easily be rectified with a little time and effort on Actinic’s part.

totally agree

[leehack]

Adrian you say in 3,000 words what most would say in 40. You believe that 20 examples of stores at 800 res or 2 brochure websites built 3 years ago by me, give you some kind of proof that the crap you talk is true. You even neglect the fact that 85% of your own users do not want to see your site at 800 res (you'll recall the questions you avoided answering regarding this).

There are exceptions to every rule, for each of your examples, I could illustrate 10 that do it the opposite way. I am not pointing out my way at all, I am simply pointing to the most stone cold evidence anyone could ever have in front of them - the internet and what the 'masses' (not Lee Hackett) are doing. I actually use 1280 and 1440 screens nowadays, so your story is empty yet again. Anyone questions your waffle and you come out doing the exact thing which you are accusing me of. If i am so bad, how stupid of you to have contacted me to have a look at doing some work for you only a few months ago. I know, I know, you didn't know me so well then...blah blah.

Your 'groundbreaking' first review of AP, wasn't the first review at all, it had all been said before in a previous review, nor does a review on AP make any sense to waffle on about checkout pages 1-3, bounce pages, popups, java and the rest of the claptrap you mentioned. Do you not understand that a PSP has little to do with the checkout phases in Actinic? if not, why have you not written to HSBC asking them to get rid of checkout pages 1 + 3?

BUT finally we do agree on something you said, and that is to not reply to each other any more unless prompted to, so please do the same for me. We clearly do not get on and for the good of the forum, let this be an end to our squabbles.

PS - although incredibly sad that you had the need to spell my name out three times alongside some site names I built 3 years ago (one assumes you are trying for company damage here as my name is not hidden anywhere), thank you for spelling it correctly, most people usually only include a single T.

[RuralWeb]

most people usually only include a single T

Hmmm - I can think of some names with double Ts

[brucet]

I just found this discussion on another forum. If you are considering trying to make your own web site PCI compliant, instead of using a third party payment gateway, it's a cautionary tale that's well worth reading. It seems to be every bit as difficult as Chris implied - if not more so.

http://www.webproworld.com/hosting-i...compliant.html

[Ginnys Attic]

I just found this discussion on another forum. If you are considering trying to make your own web site PCI compliant, instead of using a third party payment gateway, it's a cautionary tale that's well worth reading. It seems to be every bit as difficult as Chris implied - if not more so.

http://www.webproworld.com/hosting-i...compliant.html

I don't think that anyone has said they want to make there own site's PCI compliant were just hoping for a better intigration of Actinic Payments within an Actinic Shop. The Actinic Payments back end is ideal it's just the front end that our customers see and use that is off putting for me.

Interestingly from the topic you linked to i followed a link to http://www.merchantplus.com/scanalert.php where you can get 1 years McAfee ScanAlert PCI scanning for free.

Yes actinic doesnt have the name as hsbc does, but i have used it for over 3 weeks now, and not had any complaints or worry that the credit card page is not working or putting people off, i proberbly get about 1 maybe 2 a day that drop out which to me is not bad

Are these people dropping out at the Actinic Payments page after entering all there details?

[brucet]

I don't think that anyone has said they want to make there own site's PCI compliant were just hoping for a better intigration of Actinic Payments within an Actinic Shop.

What Chris was trying to explain is, if you want the payment mechanism to be integrated into the shop, then the shop site itself absolutely would have to be PCI DSS compliant - because card data would be passing through the server that the site is on.

Unless the shopper is passed to a completely different server to make the payment, and then back again, the need for the seller's site to be compliant cannot be avoided. The regulations do not allow for a third option. If they did, they would be leaving a security loophole.

What is more, at least AIUI, if card data were passing through your web site then the premises and the local PC or network from which you access the site would also have to be compliant. That means separate secure logins for each PC user (not using XPs login mechanism, which is inadequate) and controls on physical access to your building. If you use a laptop and you sometimes access your web site from home, your house would need the same levels of security. Even your kids would have to wear badges and sign in and out!

It's true AFAIK (though I'm not sure) that Actinic Payments is implemented in a way that doesn't even leave this as an option. But for most of our users, we don't expect achieving separate PCI DSS compliance to be viable. We have looked into it closely, and even we have decided that it's not an economic or practicable choice.

[Darren B]

We are looking at simplifying this along with other possible improvements as a phase 2 development.

Chris

do you mean allowing customers to host their customised payment page and logo on the AP, rather than shell out another £100 for ssl as this then makes actinic not competative, i know its only £100 but i makes basic processing more exspensive than prtox?

just a thought as you guys might not see it that way but your customers will look at the total cost

D

[Ginnys Attic]

What Chris was trying to explain is, if you want the payment mechanism to be integrated into the shop, then the shop site itself absolutely would have to be PCI DSS compliant - because card data would be passing through the server that the site is on.

Unless the shopper is passed to a completely different server to make the payment, and then back again, the need for the seller's site to be compliant cannot be avoided. The regulations do not allow for a third option. If they did, they would be leaving a security loophole.

So something as simple as a pop-up or floating window similar to what is used when the customers enter details in the 3d security window is not an option or even maybe a flash based solution which is intigrated in to the shop checkout page 3 but is hosted on the secure Actinic server is not possible either?

What i mean is the 3d security window as shown in the picture below does not bounce people off to a different site it simply floats in the browser and allows them to enter the required details

[Ginnys Attic]

do you mean allowing customers to host their customised payment page and logo on the AP, rather than shell out another £100 for ssl as this then makes actinic not competative, i know its only £100 but i makes basic processing more exspensive than prtox?

I was just reading on the streamline site an article (http://www.streamline.worldpay.com/s...ml#moi540.html) which implies to me even the Login Passwords, Customer name, What they bought and How much it cost should be protected by reliable encryption technologies (SSL)

The information that you need to ‘handle with care’
Cardholder and transaction information that needs to be stored, processed or transmitted securely, includes the following:

Card and cardholder verification details
Card number.
Card expiry date.

Personal Identification Number (PIN). This must only be taken from cardholders via their use of the PIN Pad connected to your POS terminal or system.

Passwords or pass phrases.
Digital certificates.
Biometric authentication mechanisms …and any other information used to authenticate a card payment transaction.

Card Security code (the last 3 digits on the signature strip used for cardholder not present transactions) may not be stored under any circumstances.

Customer details
Customer name.
What they bought.
How much it cost… and any other details obtained in a card payment that could identify individual customers and their purchases.

You must ensure you have appropriate operational and technological processes and procedures in place to safeguard against the unauthorised access or unlawful processing, or disclosure, of personal information. The security measures you must take include the use of the most up to date technologies to protect the personal information collected or stored on your web site and/or systems. Especially sensitive or valuable information, such as financial data, should be protected by reliable encryption technologies

[Donna Kempster]

What i mean is the 3d security window as shown in the picture below does not bounce people off to a different site it simply floats in the browser and allows them to enter the required details

Isn't this because they are already on the secure site - this is just an extra info that needs to be entered by the card holder. You only get the 3d secure popup when you are in the psp's environment?

This has been discussed many times and IMO adding your logo / colourway to the page is a vital element however overall I don't think the form looks vastly different from the forms you see with secure hosing or protox.

D

[Ginnys Attic]

Isn't this because they are already on the secure site - this is just an extra info that needs to be entered by the card holder. You only get the 3d secure popup when you are in the psp's environment?

This has been discussed many times and IMO adding your logo / colourway to the page is a vital element however overall I don't think the form looks vastly different from the forms you see with secure hosing or protox.

D

I wouldn't have thought that all of the worlds banks using 3d security have it installed and hosted on or are relying on other peoples such as a PSP's secure servers.

I've actually just seen another site which uses Actinic secure servers for capturing credit card details which was excellent and if Actinic Payments was as slick, clean and as easy it would be ideal especially if the checkout page 2 could just be tweaked a little to allow users to select the payment method and then be directly transferred when they click next to the PSP or Actinic Payment without the need for them to see a bounce page (or extra click of a next button in this sites case as it didn't bounce to Actinic secure servers) it would ideal.

[cdicken]

Just FYI I have changed the title of this thread from 'Actinic Payments Integration very poor' to 'Actinic Payments Integration' - I've left the rest of the thread as it is though. It's great to debate and discuss things there, but at the end of the day this is a forum run by Actinic and a thread title like that will end up in search engine listings etc. Hope that's cool.