Hacking a Clipper Card? Easy and Cheap Solutions to Protect Yourself

There's been some word around that someone was able to hack a Clipper card.

I know how to hack a Clipper card, just give me a saw.

Actually, it's the other type of hack, some person was able to find how to exploit the Clipper card by being able to somehow get through the encryption and obtain the data. In the worst case scenario, someone could be able to use that data to make clone cards and either make fake card balances and passes to sell, or steal one's information and make a clone card (similar to someone skimming a credit card's magnetic stripe).

Am I concerned? Sure I am, but I'm protected like an electronically tested condom (which reminds me, time to visit Costco for an economy pack).

There's no fear in this; odds are very low that someone will skim your Clipper card and ride Muni free for the rest of the month. Even then, stealing the info and e-cash balance and trying to get cash back is really difficult: You have to prove to Clipper customer service that you are the registered user of the card. Also, if Clipper knows your card is funded or partially funded with commuter benefits (even just one cent), they are not allowed to cancel the card's balance and mail you a check.

If you are just paranoid, get your tin foil hats and learn about this: There are products on the market that is able to shield your Clipper card from people skimming information. You could wrap it in tin foil, that's a cheap option. There are sleeves that people can use to slip their card in to protect it. But the problem with a tin foil or sleeve shield is that you will have to pull your Clipper card out every time when you want to scan it.

One solution I suggest is what is shown in the picture on this blog post. I use a badge holder. This one I have from Identity Stronghold works fine, and I also added a retractable reel to it so I can hook it to my belt. What makes it easy is you don't have to remove the card to scan, you just squeeze the top of the card to open it, scan the card, and un-squeeze to protect the card. I tried the holder with it protected/secured and Clipper card readers doesn't even know the card is there, but with a little squeeze, the card can be read.

So really folks, there's nothing to really fear. You don't need a replacement card if they come out with the newest generation of cards that are more secure. When more secure measures comes out, hackers always try to outsmart it. But with sleeve or badge holder that is shielded, there's no way to electronically pickpocket you.

Akit says: Don't Exploit the Clipper Card - You Ruin it For Everyone Else

Remember the Muni gate controversy where people could wave their hand and get free entry through the gates? My blog entry said that we live in a society full of rules, and if you don't respect them, you'll pay a serious price for it. I wasn't amused that a news reporter mentioned this to big TV audience, but this is nothing new because people have always ripped-off Muni in some way; hell, I see it every time I ride the 38L-Geary Limited.

In today's news, it seems like the mass media wants to grab the news football, run like hell, and at the same time, carry a megaphone and yell at people just how to exploit one of Clipper's benefits. In summary, Streetsblog SF published an article mentioning about how the Clipper card's negative balance benefit can be exploited by having someone add just a couple of dollars and ride an expensive public transit ride (like BART to SFO), get the card into the negative balance, and just throw the card away. Since obtaining the card is free with a minimum purchase of $2, going one way to SFO is a huge savings (for scumbags).

Unfortunately their co-publishing deal with SFGate made their story headline news on that website and people are tweeting the crap out of it saying it's some sort of scam, cheat, or "dirty little secret."

I'm not at all against Streetsblog SF for posting their story, the media have a right to expose weaknesses. But the co-publishing with SFGate and putting it on the top of their page as a major story just made the can of worms explode. I would have kept it low profile so only a few hundred knew, not the tens of thousands. Now, I'm going to bet the local TV news stations will start reporting all about this exploit, and making the problem even worse.

Now, all because of this mass exposure, the people who use the Clipper card honestly are now screwed because this exploit got out like a rabid dog on the loose. The negative balance feature was to help passengers prevent getting stuck without a transit ride as long as there's some kind of positive e-cash balance on the card; if there is zero balance or a negative balance, the card cannot be used again until the funds are replenished.

--------------------
Akit's opinion:

Heads don't need to roll and people don't have to be fired. The folks at MTC and the Clipper board had good intentions to have this great benefit to have the card go negative so you don't get trapped, now, it's ruined for all of us honest folks who don't abuse our transit system.

Well, there's no turning back now; the negative balance issue is going to go nuclear by who else (assuming it will), BART Board President, James Fang. Yeah, you know the guy, the one who spent $350K on a cell phone program to pay transit fares and said TransLink (former name of today's Clipper) is a total waste; but the truth is, Fang's gamble went down the toilet fast because TransLink picked-up steam big time when it was available to the public.

There is no easy solution to fixing this problem. They cannot simply eliminate the negative balance program because BART does not have exitfare machines capable to add enough value to a card to match the distance taken by the passenger, and Golden Gate Transit & Caltrain customers may go into the negative balance because they charge the maximum price and must tag-off to be charged the appropriate zones from point A to B.

To resolve this issue, MTC and Clipper will likely have to take one or more of these suggestions:

1. Stop giving away free cards, even ones where you add a minimal value to get a free card. Clipper was supposed to charge a $5 after a brief free card promo period. But... someone decided to extend the free plastic Clipper cards to JUNE 2011. Even if someone exploits the card, it won't be such a bad impact.
   
2. Raise the $5 fee to the price matching a one way ride on the most expensive transit option available (the deposit is not credit to one's account, only to be refunded if the passenger quits Clipper). If Caltrain is the most expensive at $11.25 for a one-way trip, then make that the deposit fee to obtain a card. This will piss a lot of passengers off, but it's a way to prevent ripping-off the program. If the card is negative and a person wants their deposit fee back, the deposit funds wipe out the negative balance, and the remaining deposit balance is refunded to the person.
   
3. Continue the negative balance option, on one condition: BART will not let passengers exit with a negative balance and they must use an exitfare machine that has been modified for Clipper cards to pay the balance to exit the system. Other agencies like Golden Gate Ferry may also demand it too because people can exploit the expensive cost of a ferry boat ride with the tactic used by Clipper card users exploiting BART.
4. Modify the negative balance policy in a way where the maximum is not $10 negative, make it $5; or, to gain entry to certain higher priced transit agencies (BART, Golden Gate, and Caltrain), the card must have a higher minimum balance.

In another perspective, I just wonder how many people have even exploited this at all? Sure, one is too many, as transit agencies are financially hurting. If it's a few, it's not a huge problem, but since featuring the story on SFGate to a wide audience has now destroyed its reputation, how many more will exploit it?

Be honest people, you don't want to cheat the transit agencies. Doing so may benefit yourself with financial savings, but in the long run, it hurts the transit agencies with reduced fare revenue to run buses and trains, and hurts the public with higher fares and taxes.

As usual, those cheaters and scammers will give some lame ass excuse like some little kid who just lied to their parents. They'll say something like, "I'll do what I want!" Here's my reaction to such a childish comment, "I don't mind humiliating you on my blog! Let me get my camera."

As a previous commentator said: "morals, honor and respect: Amen!"