Re: [webpayments] Should we be concerned about the use of the Browser API in a non-HTTPS environment? (#20)

>So +1 for enabling parts of Web Payments messages to be encrypted (like card tokens). -1 for requiring any top-level Web Payments messages to be encrypted (like payment responses).

Strong +1 

Data in messages will be encrypted or signed as defined by the payment method.
The payments browser API should only be available in a secure context.

---
Reply to this email directly or view it on GitHub:
https://github.com/w3c/webpayments/issues/20#issuecomment-163166070