The function below "hashes" passwords with plain, unsalted MD5 — fast, and completely broken for password storage.
The bug: MD5 was designed to be *fast* — the opposite of what you want for password hashing. Modern GPUs compute billions of MD5 hashes per second, making brute-force and rainbow-table attacks trivial. Worse, with no salt, two users with the same password get the *same* hash, and a single precomputed rainbow table cracks every account in the database at once.
Your task: fix hash_password(password, salt) to use hashlib.pbkdf2_hmac — a deliberately *slow*, salted key-derivation function — with at least 100,000 iterations.
solve then checks that your fix has the properties a real password hash needs: correct output length, deterministic given the same password+salt, sensitive to the salt, and different from the naive MD5 hash.
Sample tests