SecureMidSecurityAuto-graded

Replace unsalted password hashes with salted PBKDF2

Hash passwords with a fresh random salt each time and check them in constant time, using only the standard library.users.py stores each password as one unsalted SHA-1 hex digest and checks it with a plain ==. Two users with the same password end up with the same stored value, and a single SHA-1 round is cheap to brute-force. Rewrite hash_password and verify_password to use salted PBKDF2, with a fresh random salt on every call and a constant-time comparison. Use only the standard library and keep both signatures: the rest of the app calls them as they are.

35 min

python

Start lab

You're done when

Hashing the same password twice gives two different stored values, because each call uses its own salt.
The stored value is no longer a plain unsalted MD5, SHA-1 or SHA-256 digest of the password.
Hashing one password takes deliberate work (key stretching), not a single fast digest round.
verify_password compares in constant time, with no plain == on the password.

What it measures

Salted hashingGiving every stored value its own random salt, so it's never a bare digest of the password.

Constant-time checkComparing digests in constant time, with no plain `==` left on the password.

Contract keptKeeping both signatures, with the right password still verifying and wrong ones rejected.

Your environment

Terminal + editorA full shell in the browser

Claude CodePre-authenticated, no key setup

Isolated microVMYours alone, wiped afterwards

Start this lab

35 min

Start labYou'll sign in to Anthropos to start. The lab opens in a private cloud workspace with Claude Code ready to use.

AI Labs is part of Anthropos Workforce. Not on your plan yet? Book a demo