Security researcher finds seven embedded trackers in the Android app for LastPass password manager; LastPass says users can opt out if they want
Context & Ripple Effects
LastPass had already expanded its role beyond password storage with emergency account access and password sharing and a separate authenticator app, making the privacy practices of its Android client consequential to users’ broader credential security. The reported trackers put that posture in tension with an app built to hold sensitive login data.
The later AutoSpill research affecting major Android password managers underscores that Android credential tools face scrutiny not only over stored secrets but also over how their apps interact with the wider mobile ecosystem.
First-order effects
- LastPass Android users must actively opt out to avoid the reported embedded trackers, placing the privacy choice and its associated setup burden on customers.
- LastPass faces an immediate trust problem: tracker use becomes part of the security assessment for an app users rely on to manage credentials.
Second-order effects
- Rival password-manager providers gain a concrete privacy differentiator if they can offer Android clients with less telemetry or clearer default controls.
- Security researchers and customers have greater reason to examine password-manager Android apps for both credential-handling flaws and third-party data collection.
Third-order effects
- If credential-app scrutiny continues, password-manager competition is likely to treat telemetry minimization and privacy-by-default as security features rather than secondary product settings.
- The broader Android security debate shifts toward the combined exposure created by sensitive app permissions, embedded third parties, and credential autofill behavior.
The trend: Password managers are increasingly judged on the privacy and security properties of their mobile clients, not solely on how they encrypt stored passwords.