PSA: Popular Android password manager, LastPass, has 7 built-in trackers

LastPass is one of the multitude of password managers that iOS and Android users can choose from, but as it turns out, you may be inclined to look for alternatives. According to Exodus, a “hacktivist”-led non-profit organisation, the LastPass app for Android has seven built-in trackers—some of which reportedly gather and send data for marketing purposes.

As reported by The Register, the trackers were first spotted by security researcher Mike Kuketz, with the findings published on the Exodus‘ website. Kuketz recommends against using the password manager app, saying that the use of such trackers could invite security risks and “unexpected behaviour”, calling it a “privacy risk”.

In response, a LastPass spokesperson has argued that the data is collected to “improve and optimise the product”; the trackers do not transmit “sensitive personally identifiable user data”, according to the spokesperson. Plus, users can opt out of the data collection by heading to Account Settings > Show Advanced Settings > Privacy on the web interface.

What are they tracking?

Of the seven trackers found, four are Google Analytics trackers, while the remaining three are collecting data for MixPanel, Segment, and AppsFlyer. Segment, in particular, reportedly collects data for user profiling and ad-targeting, so this certainly raises privacy-related concerns for users.

Meanwhile, Kuketz warned that the data collected includes information on your smartphone’s model and brand, and even if biometric security has been activated on the particular smartphone. Technically, as mentioned above, the data isn’t user-identifiable, but this is still a significant concern with regards to privacy.

You can either choose to opt out using the method above, or you can also consider free alternatives suggested by Kuketz such as Bitwarden, or 1Password—which use less or no trackers for user data. As for LastPass, the platform has recently announced a new move to limit non-paying users to either “Mobile” or “Computer” platforms for the cross-sync functionality—so perhaps you might have been looking for alternatives anyway.

So, are you a LastPass user? Let us know what you think about this latest development in the comments section down below.

[ SOURCE , 2 ]