# First Package: Check if a password is compromised

**URL:** <https://discourse.elm-lang.org/t/first-package-check-if-a-password-is-compromised/2316>\
**Category:** Request Feedback\
**Created:** [October 23, 2018, 6:05am UTC](https://discourse.elm-lang.org/t/first-package-check-if-a-password-is-compromised/2316 "2018-10-23T06:05:26Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![brasilikum](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/brasilikum/32/524_2.png) [@brasilikum](https://discourse.elm-lang.org/u/brasilikum)\
**Post date:** [October 23, 2018, 6:05am UTC](https://discourse.elm-lang.org/t/first-package-check-if-a-password-is-compromised/2316/1 "2018-10-23T06:05:26Z")

</div>

Hi, I just published my first package [brasilikum/is-password-known](https://package.elm-lang.org/packages/brasilikum/is-password-known/latest/)

It uses the free and public API of [HaveIBeenPwned.com](https://haveibeenpwned.com) to check passwords agains an ever growing list of compromised, and therefore unsafe passwords.

# How does this not completely disclose the password?

[See this blogpost for an detailed explanation](https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2)  
_Tldr;_ Even if someone can read the request you make to the API, they only know the requested password is one of 478 results (on average).

# Goals of the package API

Handling passwords is always very delicate so my primary goal was to make it **very explicit** what is happening:  
This [usage example on Ellie](https://ellie-app.com/3H2VfGF9MwXa1) includes a Debug.log for exactly that reason.  
Thanks to the Elm Architecture, there is no way my package could sneakily send the password out, right?

The second goal was to make it **impossible to send the actual password** over by accident, which I achieved by creating an opaque type (custom type without exposed constructor) for the hashed password.

The third goal was to make the package **easy to use**.  
Looking at my usage example, I am not very convinced I succeeded. I could move much of the logic inside of the package, but I am not sure how to avoid sacrificing goal 1 in the process.

# Challenges

Because the request to the API returns line-based values of the format `partOfTheHash:NumberOfDatasetsFoundIn`, I had to write my own elm/parser (or did I not?). I certainly did not understand the package entirely already, but was able to build a working parser from examples and tinkering.

Creating a package was initially not easy. I initialized an app with `elm init` and was not aware of the differences between a package and an app when specifying the dependency versions. Other than that, `elm publish` guided me through the process very very well!

I did not initially think of the case that the user might change the password before the previous response returns. If not handled correctly, the response would be compared to the new password, which would result in a wrong result.

The complexity this creates for the consumer of the current API is a strong indicator for me that I have to find a better API design.

# Feedback

Please feel free to give me feedback on both the package and the usage example. Especially the update function in the latter looks like it could be expressed more readable.

What do you think of my prioritization of goals? Would you prefer the tradeoffs this brings over a simpler package API?

---

<div class="post-metadata">

**Author:** ![rauxyo](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/rauxyo/32/1426_2.png) [@rauxyo](https://discourse.elm-lang.org/u/rauxyo)\
**Post date:** [October 23, 2018, 1:52pm UTC](https://discourse.elm-lang.org/t/first-package-check-if-a-password-is-compromised/2316/2 "2018-10-23T13:52:31Z")

</div>

This sounds super interesting. I’m eager to check it out when I have a chance. I use this API myself already in JS.

---

<div class="post-metadata">

**Author:** ![rauxyo](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/rauxyo/32/1426_2.png) [@rauxyo](https://discourse.elm-lang.org/u/rauxyo)\
**Post date:** [November 1, 2018, 4:57am UTC](https://discourse.elm-lang.org/t/first-package-check-if-a-password-is-compromised/2316/3 "2018-11-01T04:57:32Z")

</div>

I finally got around to looking at this. I haven’t checked out the source, but I looked at your example usage. I think the goal of being explicit is an interesting one, but I would personally prefer to see just a single command that gives me back true or false. 🙂

---

<div class="post-metadata">

**Author:** ![brasilikum](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.elm-lang.org/brasilikum/32/524_2.png) [@brasilikum](https://discourse.elm-lang.org/u/brasilikum)\
**Post date:** [November 1, 2018, 3:15pm UTC](https://discourse.elm-lang.org/t/first-package-check-if-a-password-is-compromised/2316/4 "2018-11-01T15:15:01Z")

</div>

Thank you! Yes, I guess I arrived at the same conclusion. I will rewrite the package and ask for more feedback.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex035/uploads/elm_lang/original/1X/50a05e53677a2c3b47776d7abd0f113eb50193a1.png) [@system](https://discourse.elm-lang.org/u/system)\
**Post date:** [November 11, 2018, 3:21pm UTC](https://discourse.elm-lang.org/t/first-package-check-if-a-password-is-compromised/2316/5 "2018-11-11T15:21:59Z")

</div>

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.