This only confirms one thing: How we're doing account security is inadequate at best. Perhaps LessPass comes up short, but that's more a symptom of the broader problem than it is a mistake on the part of LessPass and its ilk.