# Password Managers--It's All about Trust and Transparency
## 6 Implications for Future Research
### All Figures, Explanations of Problems and Recommendations in the Three Password Managers  
**Recovery from a serious wrong function as there is no undo when saving new changes:** In the three password managers, if a user removes a username or password, then there is no undo function for it. Also, if the user enters a master password and confirms the operation, they will not be able to undo it, which is serious if changing a master password or email address. Recommendation: the three password managers should allow users to undo any functions within a specific time, for example, 24 h, so that they can rectify a mistake that might have been made (severity: 4-Major). **No asterisks in data entry and dialogue boxes mandatory:** Users will be confused about which data they need to fill in. Recommendation: The three password managers should use asterisks for mandatory fields that need to be filled in, such as names, email, ID and so forth, so it is clear to all users (severity: 2-Cosmetic). **The system does not prevent a user from inserting incorrect data in a field or storing incomplete data:** The three password managers do not prevent a user from storing incorrect data in a field, such as storing numbers in an alphabetic field. It allows a user to store a wrong long URL and an incorrect long phone number. Recommendation: The three password managers should  
**The use of extensive computer jargon by the system:** The three password managers have extensive computer jargon which will not be understood by all users, particularly novices. For example, \"Vault\", \"Sync\" and \"PBKDF2\" are ambiguous words for many users, along with \"Equivalent Domains\", \"Breachwatch\" and \"VPN\". Plus, LastPass uses different words for the same function; for example, when a user wants to change a master password, a new page opens and says: \"Set master password\". Recommendation: The systems should consider novice users and avoid using jargon, or provide explanation for jargon on the page (severity: 3-Minor). Figure A6: LastPass does not prevent users from storing different passwords for the same account “Twitter”. The account can appear twice on the autofill log-in “Twitter website”. Figure A7: Dashlane does not prevent users from storing different passwords for the same account. Figure A8: Keeper does not prevent users from storing different passwords for the same account. **Account settings functions are not visible or well organized (LastPass):** This might not be acceptable to all users, especially when using grey. The colour of account settings is not clear for all users. Recommendation: LastPass should use better and visible colours that suit all users (severity: 2-Cosmetic). **Users can create a master password that does not match the requirements (LastPass):** It does not prevent users from creating a weak master password that does not match the requirements and allows it to be used in the system, which is risky. Recommendation: LastPass must use a stronger policy and prevent users from creating a master password that does not match the requirements (severity: 5-Catastrophic). **Auto-change password does not work with many websites and is not visible (LastPass):** It does not work for many websites such as Twitter, this feature is not available for websites such as Hotmail, the button is not visible to all users because it looks like an error message. Recommendation: LastPass should show a list of websites for which passwords can be changed, similar to Dashlane's password manager (severity: 2-Cosmetic). **Inconvenience when generating a new password (LastPass):** Users have to figure out how to use the random generator because there is a lack of instructions, it does not show the strength in words (only in colours), so novice users might find it inconvenient to use it to generate passwords. Recommendation: LastPass needs to label weak and strong, which will be helpful for all users (severity: 2-Cosmetic). Figure 14: Auto-change password does not work in LastPass.