Innovation Nation: WePay is the anti-PayPal

http://money.cnn.com/2010/10/12/technology/wepay/index.htm

by pg • 16 years ago

88 47 16 years ago

money.cnn.com

wccrawford• 16 years ago

This is not an 'anti-PayPal' in any way, shape or form.

They offer a service that PayPal doesn't yet. It is not opposed to PayPal and it doesn't replace PayPal's services at all.

noodle• 16 years ago

i think they said "the anti-" and meant "complementary to"

pg2• 16 years ago

Presumably the author means anti- in the sense it's used in anti-matter, not the sense it's used in anti-globalization.

triii• 16 years ago

When WePay & PayPal touch they'll annihilate eachother with a huge burst of energy? :)

Too bad headlines need to be clickable rather than accurate.

billclerico• 16 years ago

i agree to some extent. our service is not directly competitive with paypal's core business. however - we consider ourselves very anti-paypal when it comes to our culture and the way we treat & market to customers

clistctrl• 16 years ago

The CEO was a speaker at this years startup bootcamp, it was an interesting talk. http://blog.wepay.com/2010/10/wepay-ceo-bill-clerico-at-star...

bmac• 16 years ago

I second watching the WePay talk.

One of the best pieces of advice I heard at Startup bootcamp came from Bill Clerico (WePay CEO) when he described building software as a community process. It seemed like an elegant way to say users are what really matter and it applies equally well to commercial, open source and personal projects.

jfager2• 16 years ago

I have long wondered why Facebook doesn't do this. Group birthday gifts, wedding registries, basically any social scenario where money needs to change hands, it seems like FB would be so well positioned to take an honest buck from.

iamdave2• 16 years ago

No.

Do you know why? Facebook acts as if it were completely incapable of knowing when far is too far. Whenever something new rolls out, it always comes off like outsourced peer-pressure. 'HEY LOOK AT WHAT EVERYONE ELSE IS DOING BUT YOU!!'

No thank you, sir.

jfager2• 16 years ago

The question of whether FB as it exists now would abuse such a system (yes, of course they would, they're awful) is separate from the question of whether or not said system would make business sense for a gigantic social network.

If FB were the kind of company that could figure out how to make money without ads or taxing 3rd party devs, maybe they'd also be the kind of company that would treat its users as customers rather than products. Hypotheticals all around.

taelor_rb• 16 years ago

Question:

So my adult (beer league) hockey team is trying to start a slush fund so that we can pay for things like new jerseys, water bottles, shared resources type stuff. We are looking at trying to get a group account for this, and WePay looks like its exactly what we need.

But the accounts we talk to say that we would have to pay taxes on this account, if its in a bank account. Would WePay be a way to get around paying these taxes? Does anyone else have any insight to how we could set this up?

Is this question way to off topic for Hacker News?

pinksoda2• 16 years ago

I really hope WePay destroys PayPal. They have screwed myself and my friends too many times.

The homepage layout is all wrong though. Poor element placement, messy typography, and the color scheme is off. It looks amateur and unpolished. All those SEO'd subpages are worthless if they don't convert.

Also:

- Upgrade to Nginx 0.7.67, there was a lot of bug fixes in 0.7.65 and 0.7.66.

- Limit the number of login attempts to prevent brute forcing.

- Don't show "That email address was not found" when someone tries to recover a password. You are giving out too much info, which can be used maliciously.

- Block scraper/vuln scanner/curl scripts by user-agent to keep away the script kiddies and botnets.

- Don't host your Javascript on Google. This gives hackers another possible point of entry. It's probably safe, but you're better off limiting points of entry.

- Use mod_rewrite as an additional layer of security. You'll need to slightly modify it to make it work with Nginx.

- Remove "access info anytime" and "post to my wall anytime" when signing up with Facebook.

- Limit SSH access by IP address.

Feel free to contact me if you need help.

seiji2• 16 years ago

Wow, "ssh wepay.com" works. Turn that off.

Once again, "cloud" doesn't mean "lol, we don't need to know about servers!"

modoc3• 16 years ago

That's totally nutty. Not sure how they passed a PCI audit like that. In fact, I don't see that they are PCI certified on their site?

ez77• 16 years ago

I must admit I didn't know the big domains disabled ssh. Naive/beginner's question: how do programmers work remotely at these companies (if it's allowed at all)? Do they ssh into other (safe) servers, from which a safe transfer is eventually made into the production servers?

Firehed2• 16 years ago

Thanks for catching that. We've spent the last week moving into a new office and it must have slipped by as we were getting everything reconfigured. It's been locked down again.

_b8r02• 16 years ago

Don't necessarily turn it off. Make sure you've hardened SSH, only do key-based authentication and limit access to specific source IP addresses or use something like fail2ban.

Then spend the time to properly look at your information security requirements and develop a plan to comply with them.

If you just turn off SSH you're going to have a lot of pain with little gain or loss if it's properly configured.

smeagol2• 16 years ago

thanks for the feedback!

can you be more specific about how we can improve the home page? we're constantly trying to improve it, but our oldest (and admittedly ugliest) one always converts the best. tell me the dominant page color and i'll know which version you're looking at.

pinksoda2• 16 years ago

White and blue are good colors for your industry, but the current homepage has too much blue above the fold. The blue is slightly too vibrant also. You want to be careful about the saturation of your colors. Vibrant/Saturated colors are subconsciously distracting and unprofessional. The hurdle to trust a vibrant website is much higher.

"WePay helps you collect, manage, and spend money." should be displayed above the fold and have embedded screenshots or an embedded video nearby. I don't recommend popping it up in a lightbox.

Include a "create account" link near your "Sign in" link. The top right corner is prime real estate and needs a call-to-action for current users and potential users.

The site seems segmented because of the various different styles and content widths used. I found three different widths so far (1010px, 960px, and 770px).

The logo needs to go. It's really bad.

Move "featured in" to the bottom.

Move "What kinds of groups are using WePay?" up more. Remove the italics on the links.

Take a look at this: http://i.imgur.com/4zHX7.png - I threw it together in 5 minutes, so don't judge it too much. White is the primary color here and you'll notice that it is visually easy to follow. Looking at the current WePay is actually straining on the eyes.

bdclimber14• 16 years ago

Don't host JS on Google? Do you mean libraries like jQuery? I'm curious because we use Google for jQuery and a few other libraries. I've never heard this to be a security issue, and I'm not entirely sure how it would be. Nonetheless, security is all about cost-benefit, it may be worth the security risk for the page load speed increase with Google.

modoc3• 16 years ago

It's a security issue because someone can compromise google's CDN, or cache poison, or DNS poison/hijack that, and can inject malicious JS code into a large number of websites with one attack. If you're running a payment related it pays to be paranoid.

sbov2• 16 years ago

> - Don't show "That email address was not found" when someone tries to recover a password. You are giving out too much info, which can be used maliciously.

Does this really matter if a site only allows 1 registered user per email address? I can farm this information by trying to sign up a new account.

csomar• 16 years ago

but when signing up there is a captcha, unlike the login page.(Okay, unless it's AJAX).

sophacles• 16 years ago

Even if this is true[1], it never hurts to consciously limit the places where information flows out of your system. The idea is that securing one point is easier than securing n points.

[1] I don't doubt the flow of information, but the rate at which that information can be leaked through a signup page can be severely limited compared to a password recovery page.

dbul• 16 years ago

Someone I know recently told me about her nightmare when she was collecting money for a class reunion via PayPal last month: she had to register as a non-profit, and PayPal wanted her water bill to prove that they were indeed a non-profit despite being recognized by the government as one. So much hassle; I wish I had known she was going to do that so I could have told her about WePay, especially with this kind of customer service:

  A call to WePay's customer service department quickly
  sorted out the problem. Plus, the company gave him $20
  for the inconvenience.

jscore2• 16 years ago

Homepage is too busy. Simplify it a bit.

jscore2• 16 years ago

Sounds like a play from the book REWORK: Mobilize against an enemy (or something like that).

It's just words; WePay is not another competing product, it's basically a bunch of features that PayPal can implement and with >80M accounts, they can easily kill it.

Say what you want about PayPal, but each one of you should read PayPal Wars to learn the inside story of how PayPal worked and competed. They basically pioneered the person-to-person payment service and faced a myriad of issues before eventually selling to eBay.

Innovation Nation: WePay is the anti-PayPal

Related Stories