The feature requires that the designated person has a Lastpass account. This works then because each Lastpass user has a public key, and private key encrypted i

The feature requires that the designated person has a Lastpass account. This works then because each Lastpass user has a public key, and private key encrypted inside their vault. When you designate someone for emergency access, it also encrypts your vault with their public key. In a way the person and Lastpass hold each other accountable because: 1. Lastpass only gives the encrypted vault data to the emergency contact after the waiting period. They cannot decrypt the vault without having the encrypted vault data. 2. The person's private key is encrypted inside their vault by their master password. As lastpass doesn't know their master password for their vault, lastpass doesn't have the key to your vault. I would not call this "wildly insecure", but definitely has more risk factors than not doing it. For most people I think this is a reasonable tradeoff if they want people to be able to access their data without huge inconvenience.