Lion Cipher Lab
Block breached passwords the way HIBP does — build the k-anonymity range check yourself, offline
- Identity & Access Management
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Reusing a password that has already leaked is how most account takeovers actually start — the attacker is not guessing, they are replaying a breach dump. NIST SP 800-63B tells you to screen new passwords against those dumps, but naively sending a password (or even its full hash) to a checker just leaks the secret you are trying to protect. Building the k-anonymity range check yourself — where only five characters ever leave your machine — teaches the single most elegant privacy trick in identity, and leaves you able to bolt real breached-password screening onto any signup or password-reset…
What you'll learn
- k-anonymity range search
- breached-password screening (NIST SP 800-63B)
- SHA-1 prefix/suffix hashing
- building a mock HTTP API with Python stdlib
- reasoning about what data a check leaks
Steps in this lab
- The problem: screening breached passwords without leaking them
- Set up: a folder and a working Python 3
- Build a tiny local breach corpus and hash it
- Stand up a range server that speaks the HIBP shape
- Write the client that keeps the secret at home
- Measure k, and screen a whole list to see the block rate
- The real production path — and why range search beats sending the hash
- Be honest about what this does NOT do