All right, let's get to our first step of building our secure password checker.
Now in here, I have a check, my passport file.
You can do the same.
And then I have my terminal right over here.
What we want to do is initially import the requests module.
If you haven't, well, then you can install the requests module.
The request module is going to allow us to make a request.
So remember, it's kind of like having a browser without well, the actual browser.
We can just manually request something as if we have a browser and we get some data back.
So the way we can actually use the request module with the password API is that we can have the password
API URL, which I'll just tell you what it is.
It's https.
Colin slash slash API post passwords.
Dot com.
And then we give it a range slash.
And in here this is where we give it the password.
So we can just do plus.
And let's just for now do.
Password.
One, two, three.
So that's the URL that we're going to use.
Let's make this a little bit smaller like that.
Now in here, we're going to get a response by doing the requests.
Dot get.
And let's just type this in and see what happens.
If I save and run this program and remember, we don't have the ability to type in the passwords yet,
so let's just run the file.
All right, so we get something, but it looks like an error.
And that's because I did https.
Silly me.
But again, I want to show you that.
Yeah, right here.
I'm able to read the errors and it looks like it it's an invalid schema.
No connection adaptor for well https.
So if we run that again.
All right.
It looks like it worked.
No errors.
But let's print this out to see why we get so print response.
And I'm going to run this.
And we got response 400.
Hmm.
Now a response or 400 is not good.
Usually that means unauthorized or something's not right with the API.
Now these response codes are something we'll get into in the Web development section of the course.
But it just means that 400 is not good.
We want a response of 200.
200 means.
Okay.
And the reason this happens is because this is not how the API actually works.
You see here we just gave it a password.
But the way that this API works is it uses something called hashing.
Now, what does that mean?
I'm going to include a bonus lesson after this one so that you can learn a little bit more about hashing.
But I have here this website that I'm going to link to, and let's make this a little bit bigger.
Hopefully you can see it's a SHA1 hash generator.
Now hashing a password.
It's something that you should always do.
Let's say you're saving a user's password.
To a database.
You should never store a user's password in what we call plaintext.
That is exactly what the password is.
Instead, we want to do something called hash it.
That is, run it through a hashing algorithm to make it gibberish.
So when I do password two, one, two, three here and I click generate and I scroll down.
This is the hashed password.
Notice here that as I change this password, this changes as well.
But the key here and this is something that we'll talk about in that bonus video is that hashing is
a one way function.
So there's many different hashing algorithms, there's empty fives, there's SHA two, five, six,
we're using SHA one because this is what this API is using and SHA one essentially just hashes.
It's an algorithm that is a function that does this gibberish output of password.
One, two, three.
But no matter how many times we generate password 1 to 3, it's always going to be the same hash.
So this way we can actually check if somebody types a password and we already have the hashed version
of a password and let's say a database, we can actually compare the hashed version of this password
to the database.
Hashed password.
Again, don't get too confused here.
Hopefully in that bonus video, we'll cover this a little bit more.
But the key thing is that this API, because we want to be as secure as possible, is, well, we don't
want to send over the wire our real password.
Instead, we want to send this hashed version of our password.
So if I copy this and put it over here, this is what we should be sending to the API.
But here's the problem.
This is still not super secure because anybody can come now and type in and keep guessing, keep guessing,
keep guessing and eventually hit on password 1 to 3 and see, oh, this hash is the exact same one as
this hash.
So they will know that this is our password.
So this API uses a technique called K anonymity and this is actually a modern technique that big companies
like Google, Facebook, Netflix, Amazon all use.
K anonymity allows somebody to receive information about us yet still not know who we are.
How does this work?
By the way, this is actually a technique that is used a lot, especially now, where using personal
data for companies, it's frowned upon.
So ideally you don't want to give your personal information to companies.
So some companies that care about security and privacy use this anonymity to track you, but still not
know who you are.
Now, the way this works.
Is that we only give the first five characters of our hash password.
So one, two, three, four, five.
So if I remove this, what this API is going to do is it has a list of all the passwords that have been
leaked.
However, all those passwords are hashed with the SHA one algorithm.
So it's going to look in its database of all these passwords and pick all the hashed passwords that
have the first five characters that match this.
So this way, with the response, we're going to get all the passwords that are hashed that have this
so that on our end, when we receive that response, we can check the rest of the hash function.
This way, this API is never going to know our full hash and therefore never ever be able to guess our
password.
They'll just know that we have this tiny bit of a hash function that could match any hundreds of passwords.
How cool is that?
So if I actually save this and run.
I get a response of 200.
Awesome.
All right.
Let's take a break, learn a little bit more about hashing and see you in the next video.
Bye bye.