lastpass-cli

This is very cool. After going from KeePassX to LastPass to 1Password, I'm back to using (mostly) KeePassX (and occasionally LastPass since $work has LastPass Enterprise). I would very much love to be able to host a private instance that everyone at $work can use and a private one that myself and my family (for example) can use. Also, AgileBits has 80 employees now!? Wow, I guess that subscription model really is paying off for them. :/ Off-topic: The author, "jcs", is also an OpenBSD developer and the guy behind "Pushover" [0] ("receive unlimited push notifications on all of your devices") which is an awesome service some HN'ers might be interested in. (No affiliation, just a very happy user.) Edit: Somewhat related... for the LastPass users who are terminal junkies, like me, you might like "lastpass-cli" [0]. I actually use it in place

Lastpass has a nice official commandline client: https://github.com/lastpass/lastpass-cli I use an alias like this to easily copy a password onto the clipboard: alias lclip='lpass show --password --clip'

I'm talking about the authentication to the lastpass server, not the decryption itself. Lastpass won't serve you the encrypted blob if you don't authenticate with their servers. To do this it computes a different key (using a different derivation function, but using the same "master" password as the encryption key) that it uses to log into the lastpass server. This key cannot be used to decrypt the blob because of the different derivation function, but the client asks the server how many rounds of the kdf to use for a given user by posting its email to https://lastpass.com/iterations.php . As you can see it defaults to 5000, but the client will gladly accept any value. Therefore the server can tell the client to send a key derived from only one iteration, it which case this code is run: https://github.com/lastpass/lastpass-cli/blob/623b34