The major commercial password manager companies claim to have a "zero knowledge" system. This means the master password of the user is the only way to decrypt the data and it's is not stored anywhere. So even the company doesn't know the master password or has access to the users data. I've put hands on KeeperSecurity, LastPass, Dashlane and 1Password.
So far so good. But KeeperSecurity and LastPass provide a possibility to recover an account when the user has lost his master password. I mean how is this possible, if the master password is the only way to access the data and nobody knows it except the user?
KeeperSecurity manages this by saving a second copy of the users data which is not encrypted with the master password, but with a security question, previously asked, and answer. But this means there is another way of accessing the users data. And there is the chance that somebody knows the security answer. Okay the recovery requieres access to the email account and to a second auth factor. BUT still there is another chance of accessing the data besides the master password!
Dashlane and 1Password do not provide an account recovery.
How can those password managers pretend to be secure and claim that the master password is the only way to access the data, but on the other hand provide a recovery option.
What do you think about password managers with recovery option? I mean everybody who is using a password manager should be aware of loosing the master password.
Is a password manager with recovery option really trustworthy? Maybe someone could give a little valuation about security of such recovery systems.