If you forget your LastPass master password then LastPass provides the possibility to recover access to your vault using a One-Time-Password (OTP) which is stored locally but is initially disabled.
The procedure is described here:
It goes along these lines:
- Go to the account recovery page.
- Enter the e-mail address you use as login to LastPass
- You now receive an e-mail with instructions on how to proceed, and a locally stored One-Time-Password has been enabled.
- Using this password you should be able to restore access to your password database without using your master password. (I don't know how this works, but maybe LastPass has a 2nd copy of your password database encrypted using this OTP in addition to the database encrypted using the master password.)
But as many people have their mail program setup to the mail account they use as login to LastPass doesn't this mean that if somebody gets access to your machine and manage to login then they can:
- Enable the locally stored OTP using the recovery link.
- Read the instructions sent to you by e-mail because the also have access to your local email program.
- Gain full access to your entire password database.
And they can do so without knowing your master password?
Is there something I have misunderstood?