haveibeenpwned: Library for checking for weak/compromised passwords.

[ bsd3, library, program, web ] [ Propose Tags ] [ Report a vulnerability ]

This library uses the haveibeenpwned database to check for weak or compromised passwords.


[Skip to Readme]

Downloads

Maintainer's Corner

Package maintainers

For package maintainers and hackage trustees

Candidates

  • No Candidates
Versions [RSS] 0.2.0.0, 0.2.0.1
Change log CHANGELOG.md
Dependencies base (>=4.11.0 && <4.15), bytestring (>=0.10.8 && <0.11), cryptonite (>=0.24 && <0.28), data-default (>=0.7.1 && <0.8), haveibeenpwned, http-client (>=0.5.13.1 && <0.7), http-client-tls (>=0.3.5 && <0.4), http-types (>=0.12.1 && <0.13), monad-logger (>=0.3.29 && <0.4), mtl (>=2.2.2 && <2.3), safe (>=0.3.17 && <0.4), text (>=1.2.3 && <1.3) [details]
Tested with ghc ==8.6.5 || ==8.8.4
License BSD-3-Clause
Copyright 2019 Obsidian Systems LLC
Author Obsidian Systems LLC
Maintainer maintainer@obsidian.systems
Category Web
Bug tracker https://github.com/obsidiansystems/haveibeenpwned/issues
Source repo head: git clone https://github.com/obsidiansystems/haveibeenpwned
Uploaded by abrar at 2020-11-18T20:20:45Z
Distributions NixOS:0.2.0.1
Executables readme
Downloads 390 total (3 in the last 30 days)
Rating (no votes yet) [estimated by Bayesian average]
Your Rating
  • λ
  • λ
  • λ
Status Docs uploaded by user
Build status unknown [no reports yet]

Readme for haveibeenpwned-0.2.0.1

[back to package description]

haveibeenpwned

Haskell Hackage Hackage CI Github CI travis-ci BSD3 License

A haskell library for checking passwords against the haveibeenpwned.com database.

By means of this library you can do some basic strength check on new user passwords. Common weak passwords like many plain English words or also many stronger passwords which happen to have been leaked will likely be found in the database and can thus be rejected.

Example

The example below can be built and run using cabal build exe:readme or cabal repl exe:readme.


> {-# LANGUAGE OverloadedStrings #-}
>
> import Control.Monad.IO.Class (liftIO)
> import Control.Monad.Logger (runStdoutLoggingT)
> import Control.Exception (bracket_)
> import Data.Text as T (pack)
> import Network.HTTP.Client (newManager)
> import Network.HTTP.Client.TLS (tlsManagerSettings)
> import System.IO (hFlush, stdout, hGetEcho, stdin, hSetEcho)
>
> import HaveIBeenPwned
>
> -- | A really simple demo of the hibp functionality. Asks the user to enter
> -- a password and then uses the hibp api to check whether that password has
> -- been pwned.
> consoleHaveIBeenPwned :: IO ()
> consoleHaveIBeenPwned = do
>   runStdoutLoggingT $ do
>     mgr <- liftIO $ newManager tlsManagerSettings
>     p <- liftIO $ getPassword
>     let hibpEnv = HaveIBeenPwnedConfig mgr "https://api.pwnedpasswords.com/range"
>     p' <- flip runPwnedT hibpEnv $ haveIBeenPwned $ T.pack p
>     liftIO $ case p' of
>       HaveIBeenPwnedResult_Secure ->
>         putStrLn "Your password does not appear in any known breaches.  Practice good password hygene."
>       HaveIBeenPwnedResult_Pwned p'' ->
>         putStrLn $ "You have been pwned! Your password has appeared in breaches " ++ show p'' ++ " times."
>       HaveIBeenPwnedResult_Error ->
>         putStrLn "Network Error, try again later"
>
> getPassword :: IO String
> getPassword = do
>   putStr "Password: "
>   hFlush stdout
>   password <- withEcho False getLine
>   putChar '\n'
>   return password
>
> withEcho :: Bool -> IO a -> IO a
> withEcho echo action = do
>   old <- hGetEcho stdin
>   bracket_ (hSetEcho stdin echo) (hSetEcho stdin old) action
>
> main :: IO ()
> main = consoleHaveIBeenPwned