Welcome back.
We just learned about the Password API and how this API allows us to trust no one.
That is, we only trust ourselves and we're only going to give the bits of information that we feel
comfortable to the API so that it gives us a response with some data that we can then calculate on our
own machines that are hypothetically more secure.
So what we did here is that instead of giving the entire hash of our password, we just give a little
bit of it.
The first five characters, now they have close to 600 million passwords in their database and the website.
Now maybe just knows that we're part of several hundred people that have a similar starting hash, but
they're never going to know our password.
But with this response data, we can now check our full hash to see if the password has ever been postponed
or has ever been hacked.
So let's start writing our program, because ideally in this response, I now have maybe several hundred
lists of these hashes that I can check against.
Let's think about what we want to do.
So ideally we have, let's say, a function, and this function will be the request.
API.
Data, which is what we've done here.
So we'll move that down here once we're ready and here, we'll give it the query characters.
So that is we're going to give it this hashed version of our password.
So this is going to be a function that for now we'll just pass.
But this is going to request our data and give us a response.
Next with this response, we actually want to check so we can say that we want to check the pwned API
check and in here we'll give our password.
That is our actual password in our case will be password.
One, two, three.
And in here we want to do some sort of a check.
We want to say check.
Password.
If it exists in API.
Response.
From up here.
So for now, we'll just pass that.
So let's work on the first one.
That is request API data.
We've already done some of this over here.
Right.
I'm actually going to move this code.
Up here.
Make sure we have the padding now in here instead of this strength.
I'll actually give the query character that we'll call the function width so that it's dynamic.
And again, we'll request the URL, we'll have the response.
And in here we'll do a check.
We'll say if response dot status because remember, we can check our response if the status is 200 or
in this case, let's say, if the status is not equal to 200.
In that case, let's just raise an error.
So I'll say raise we'll do a runtime error and we'll say, well, let's use an F string and we'll say.
Air.
Fetching.
And then we'll give it the status code so that it is response status.
Oh, and actually this is status code.
So let's just do status code here and then we'll just say check.
The API and try again.
All right, so this should be our error if we make a mistake.
Let's just test that out.
I'm going to just.
Let's do an API that doesn't exist.
So I just run some gibberish here.
If I save and run this.
Well, I have to actually run this piece of code.
So let's just do request API data and the query character is going to be.
One, two, three.
And you know what?
This is going to air out whether I do that or not.
So let's just do this because it's not the Hatch version.
And I actually get a python error of type here can only concatenate string not int.
So we can just convert this to a string because remember we're adding it to the URL here.
Again if we run this.
All right, look at that.
We've raised a runtime error.
We have a runtime error.
Error fetching 400.
Check the API and try again.
All right, so this part is working, but in this case, if we don't have that error, let's just say
that we will return the response.
Again, we're just writing small, simple functions.
In this case, we just want our request API data so now we can use it throughout our code.
Awesome.
Now, this next part is a little tricky because we have to run our password through the SHA one algorithm.
Luckily Python has a built in module for us to do this so we can actually do import hash lib.
As you can see, it's a built in module, so you can read up more on it if you want.
In our case, we're able to do SHA1 hashing like we did on that website with this library.
In here.
What we're going to do is, first of all, I want to be able to hash my password.
So let's remove the past here and say sha one password and we can use the hash lib like this hash lib
dot SHA one, which is the hash algorithm we want to use.
And this is going to be a little tricky, but you can just read the documentation.
I'll just show you how to do it.
In our case, we can do password and we want to encode in UTF eight.
Which is pretty standard.
Actually, you know what?
Let me show you what this does.
So I'm going to say print and I'll just do password and code UTF eight.
So let's just do that for now.
For now, I'm going to comment that out.
So I'm going to call Pwned API check and we'll do one, two, three.
Let's clear this.
Going to save and run this piece of code.
All right, it's encoded.
You see this little B over here in UTF eight?
I'll actually show you what happens when we remove the ENCODE after this.
Next, when we use the hash lib SHA1.
So let me just copy this.
If I just run this.
I get a SHA1 hash object.
Now after this we can call dot hex digest like so.
And if I run this.
Hmm.
Well, how can we check this?
Well, we can go to hash lib and just simply search for hex digest.
So in here, at any point you can ask it for the digest of the concatenation of the data, blah, blah,
blah, hex digest.
So that doesn't really explain anything for us.
Let's just go to the next part and the next part and there you go, Hex Digest.
It returns a string object of double length containing only hexadecimal digits.
This is just something that we need to do in order to convert this object into this hexadecimal string.
The next part, in order to agree with the API, is to convert all of this to uppercase.
So if I do upper here.
And I save and run this again.
Everything is in uppercase, just like we saw when we looked at Sha one.
So this is just something that, again, you don't really need to know.
You just have to you can Google around and see how to actually use this.
Now, let me show you what happens when we don't use UTF eight ENCODE.
So if I just do it like this and I run this.
You see that?
I get an error.
The Unicode objects must be encoded before hashing.
So it actually gives you a nice error and we can just encode it using UTF eight like that.
So this is just the standard.
Again, nothing too crazy.
You can read up on encoding and UTF eight if you want on your own.
The key here is that by the end of it we have a SHA one password that we can send.
So let me just copy all of this.
Going to remove the print.
And in here, we'll have our SHA one password.
Awesome.
So for now, let's just return this SHA one.
Password.
And if I run this.
Well, it looks like our code is working.
We're not printing anything, but hopefully.
We are getting this sha one password.
Now in the next video I actually want to try and send this to our API and see what kind of response
we get.
Let's do that.
Take a break.
I'll see you in the next one.