search

lastpass / lastpass-cli

LastPass command line interface tool
GNU General Public License v2.0
2.85k stars 289 forks source link

Feature request. Allow OWASP FIPS-140 Password Iterations 310000 or more #642

Open MsJamie opened 1 year ago

MsJamie commented 1 year ago

Can you add the ability to use alternative settings for Password Iterations without breaking lastpass-cli?

For example I'd like to use the OWASP FIPS-140 compliance https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html

If FIPS-140 compliance is required, use PBKDF2 with a work factor of 310,000 or more and set with an internal hash function of HMAC-SHA-256.

However as related to https://github.com/lastpass/lastpass-cli/issues/604 you have to use 100100 or receive unknown when trying to login

0xdevalias commented 1 year ago

Related:

0xdevalias commented 1 year ago

Looks like May 1 will be when this version of the CLI ceases to work correctly (unless they make required changes before then):

image

Originally posted by @0xdevalias in https://github.com/lastpass/lastpass-cli/issues/604#issuecomment-1522663467