# Password Managers--It's All about Trust and Transparency
## 6 Implications for Future Research
### All Figures, Explanations of Problems and Recommendations in the Three Password Managers
Figure 15: Auto-change password in LastPass does not support all websites, for example, Hotmail. Personal email is hidden. **Recovering a LastPass account is difficult as it has to be from the same device and browser and requires a smartphone (LastPass):** If a user forgets the master password, they must use the same computer and the same browser, and install a browser extension, to recover the account, plus use a smartphone app for the recovery process; otherwise, the account will not be recovered and all data will be lost, except if emergency access is used. Recommendation: LastPass needs to alter the way users can recover an account to only using an authentication app, because using the same device and browser, and installing an extension, is a big restriction to complete the process of recovering an account (severity: 4-Major). **Dark colours used for the main menu (Dashlane):** This might not be liked by all users, especially when using dark colours for the menu and a small font. Recommendation: Dashlane should use better and brighter colours for the menu that suit all users (severity: 2-Cosmetic). **Users can create a master password that meets strong requirements, but only by using an email address (Dashlane):** It imposes a strict master password policy on users (at least 8 characters, 1 uppercase, 1 lowercase, 1 number); users have to follow this policy, otherwise they will not be able to complete registration. However, users can use an email address which is registered in Dashlane as a master password. The only thing that needs to be changed is replacing a lowercase letter with an uppercase and adding a number. Recommendation: Dashlane should prevent the use of an email address as a master password, and prevent the use of names of users, birthdays and any registered personal information (severity: 5-Catastrophic). **Figure** 19: Users of Dashlane can create a master password using their email address. **Changing the master password while synchronization is disabled causes a loss of data stored on other devices (Dashlane):** Users have to be careful when they want to reset the master password because if they do not have a premium membership and change the master password, then all data stored on other devices will be lost. Recommendation: Dashlane should make this feature \"free\" for at least one extra device to encourage people to adopt it (severity: 4-Major). **To recover an account in Dashlane requires contacting the business team and is \"not free\" (Dashlane):** Unlike LastPass, users have to have a business membership to be able to recover an account through a third party, or add an emergency contact who can recover passwords; otherwise, users will not be able to recover data if they forget the master password. Please note that Android users are able to recover their account using their own biometrics. Recommendation: Dashlane should allow users of all devices to recover their account using an authentication app, SMS code or sending a code to a registered email address (severity: 4-Major). **Users have to install the Dashlane app to register and use all its functions and features, because it is not available on the webpage orin the browser extension (Dashlane):** Users have to install the application to use specific features and functions because the webpage and browser extension do not have these features and functions. Recommendation: Dashlane should add important features to the webpage and browser extension, similar to LastPass, and for free, so that users do not have to install a separate app on their devices (severity: 3-Minor). Figure 14: Recovering a Dashlane account requires a business team membership (not free). Figure 14: The application has all the features and functions, while the webpage does not. **User can create a very weak master password (Keeper):** It does not impose a strict master password policy on users (at least 6 characters long); thus, the user can create a very weak password for example, 123456.