I've been working on a reimplementation of the LastPass command line client lately and while I was also a bit surprised when I found out that the login URL was

I've been working on a reimplementation of the LastPass command line client lately and while I was also a bit surprised when I found out that the login URL was "https://lastpass.com/login.php" https://lastpass.com/login.php" I didn't really think much of it. In the end the server side of things is really not critical since it only stores an encrypted version of the blob. Sure, it looks a bit sloppy, but if it works... The real weakness of lastpass is and always will be the clients, in particular those browser extensions that can update in the background and are difficult to audit. But these browser extensions are also the reason I'm not using something like "pass" or even a custom GnuPG-based solution. It just works on any machine regardless of the OS without any hassle. So far the C code of the CLI client looks decent enough. Not amazing but nothing really stands out, besides maybe the key derivation algorithm they use: they query the server for the number of rounds to use when deriving the keys and if the server replies "1" they fallback on a single round of SHA256 salted with the username. It's probably some kind of compatibility mode but that seems rather weak to me. If somebody compromised the server they could have it tell the client that the number of rounds for any client is 1 which will cause the clients to send a "simple" SHA256 of username+password which will be a lot easier to bruteforce than the default 5000 rounds of PBKDF2.