Welcome back.
How are we going to build this tool?
How are we going to know what passwords have been hacked and what does it really mean anyway?
Well, passwords get leaked all the time.
We've heard about data breaches, right?
Facebook has been hacked with data breaches.
Equifax, LinkedIn, Yahoo!
All these big companies sometimes get their databases leaked.
And essentially what happens sometimes is our usernames and passwords get leaked to the public.
And hackers, what they do is they compile these lists of leaked usernames and passwords and essentially
try to log into different services.
So there are databases or you can think of them as massive Excel files of all emails and passwords that
have ever been leaked throughout history.
And there's actually a website created by somebody called Troy Hunt, who's a very famous security researcher,
and it's called Have I Been Pont?
And what you can do here is you can actually enter your email address and say, Let's go, Andy, at
gmail.com.
Has this ever been leaked?
Oh, no, it looks like it's been --.
So it looks like it's been pawned on 88 breached sites and found 27 pastes.
What this means, essentially, is that this email has been part of a data breach.
So maybe I used this email as my Facebook login.
Well, when Facebook got hacked and some users maybe stole user information, well, this email was
part of it, as a matter of fact, out of 488 breaches.
And if I go to passwords here, you can actually do the same thing about passwords.
I can check my password and you can see over here that it doesn't show.
And I can click over here to see if it's been pawned.
Now I just enter some gibberish here and looks like, nope, no -- is found.
But why does this matter?
Why do we care that emails and passwords have been leaked?
Hackers use something called dictionary attacks and a dictionary attack.
Well, kind of like a Python dictionary uses a massive dictionary with the key and valley of, let's
say, a username and password and just tries to log into websites using these massive lists of information.
And if your username and password has ever been leaked while a hacker simply runs what's called a brute
force attack, where it just loops through all these leaked usernames and passwords and tries to log
in.
So maybe going into Facebook and just looping through this massive list, eventually they're going to
hit something and be able to log in.
Now, here's the thing.
This isn't a web development course.
I mean, this course is about Python.
And although we have a section on web development, what I can tell you is that most of the time, even
though I trust this website, it uses something called HTTPS, which is encrypted.
I or you should never really trust a website with your password.
Yes, maybe a big website like Facebook, maybe Google we trust.
But ideally you don't want to send your password like this over the internet.
Because what's happening here, as soon as I click this, is that it's being transferred to a server
somewhere in the world.
It's traveling through the Internet wires and somebody could intercept it.
So there's actually a more secure way of doing this.
And this is where we're going to build this website actually gives us a password API for us to do this
and check our passwords, but in a more secured way because sure, we might trust this website, but
the best security is to trust no one.
Right now, what I'm about to show you and what we're going to do is actually a technique used by legitimate
password managers like keeper one password you might have heard of, blur sticky password.
These are expensive password managers that keep your passwords secure, but we're going to build that
ourselves because we're programmers.
So in the next video, we're actually going to start coding a bit and learning about this Passwords
API.
I'll see you in the next one.
Bye bye.