SecureMidSecurityAuto-graded

Replace unsalted password hashes with salted PBKDF2

Security fundamentals: whether the accepted way to store credentials is known, and can replace a weak scheme cleanly.The user store saves passwords insecurely: a bare, unsalted SHA-1 of the raw password, verified with a plain equality comparison. That is three classic mistakes at once — no salt, so identical passwords collide and rainbow tables apply; no key stretching, so brute force is trivial; and a comparison that leaks through timing. Replace it with salted PBKDF2, a fresh per-user salt, and a constant-time verification.

35 min

python

Start lab

You're done when

Every stored credential carries its own unique salt — two users with the same password store differently.
The stored value is not a bare unsalted digest — it is properly stretched.

What it measures

CryptographyApplying salting and key stretching correctly, and choosing parameters that make brute force expensive.

Application securityRecognising all three failures in the shipped version rather than fixing only the obvious hashing one.

Safe comparisonVerifying digests in constant time so the check itself does not leak information.

Your environment

Terminal + editorA full shell in the browser

Claude CodePre-authenticated, no key setup

Isolated microVMYours alone, wiped afterwards

Start this lab

35 min

Start labYou'll sign in to Anthropos to start. The lab opens in a private cloud workspace with Claude Code ready to use.

AI Labs is part of Anthropos Workforce. Not on your plan yet? Book a demo