# Password Managers--It's All about Trust and Transparency
## 4 Results
### Usability Test and Interview Study
#### 4.2.2 Results of the Interview Study
We asked our participants if they checked the strength of the master password when they created it in LastPass and if they had any comments. Please note that we intentionally made a weak master password \"h1234567\" for the usability test to find out if our participants would pay attention to its weakness. Twenty-four participants said they checked the strength of the master password and the most relevant comments are: the master password in LastPass has a weak policy, not strong enough and less secure. Also, LastPass should require special characters and should have a strong and strict policy. One participant did not know if the master password was stored safely or not. Besides, we asked the participants if they knew what would happen if the master was compromised. The answer from 28 participants was that they did know what would happen while only two participants answered \"No\" (one user and one non-user). When we asked our participants for comments, 23 participants stated that their stored passwords would be compromised if the master password was stolen. Other participants suggested using another layer of protection such as multifactor authentication to accept the log-in or reject it, they would use two-factor authentication to prevent any log-in from a different machine even though it is a headache. Likewise, one participant suggested that a password manager should provide a button for an emergency contact to shut down the account in case the master password was stolen. During the usability test, the participants came across a feature called \"emergency\" which is offered by many password managers like LastPass, Dashlane and Keeper. This feature allows a user of LastPass (owner) to give a permission to another LastPass user (emergency contact) to access passwords in case the owner forgets the master password and cannot access their LastPass account. So, when we asked our participants if they would use this feature and add an emergency contact to recover stored passwords, 17 participants said \"Yes\", while 13 participants said they would not add an emergency contact. In detail, 14 users would use an emergency contact compared to only three non-users. Many participants gave some interesting reasons for not using this feature, for example, they trust no one, the emergency contact might get hacked so a hacker can access my account. One participant who would not use an emergency access said \"I do not want to share my passwords with anyone\". On the other hand, participants who said they would use an emergency contact stated that it is the best feature in a password manager, others said they would use it if it is free to add a personal account that belongs to them, while a few participants said they would add someone else they trust. One user participant who would use an emergency contact stated that \"I would use it in case I die\". Furthermore, participants were asked a set of questions that related to the place and process of storing passwords in password managers, trust in storing passwords and deleting them permanently from password managers (Table 12). The 30 participants were asked if they know where online passwords are stored in password managers. We found that seven users out of 16 did not know where passwords are stored while nine non-users do not know. The most common comment made by participants is that online passwords are stored on the provider's servers, other participants said they are stored somewhere in the cloud, while one participant said they are stored online in a database. So, these comments indicate that some participants were aware of storage places (provider's server and cloud). However, one user said passwords should be stored in a safe place and we should know how they are processed. When we asked our participants about how passwords are processed in a password manager, most participants said they did not understand how password managers process online passwords. In detail, ten users of password managers and 11 non-users did not know the process.