If you're looking to compare a cloud service like LastPass to a local application such as KeePass, then yes, there is a security tradeoff.

With an application such as KeePass, where you have full control over the storage of your password database (presuming you're not putting it up on DropBox or something), the only attack surface you have to worry about is your own system and the devices on which your password database is stored. Generally speaking, these are not likely to be subject to targeted attacks (or, as the media likes to call them, APTs). As long as you follow regular security best practices on your system (apply software updates, use antivirus, keep a properly configured firewall and/or router between you and the Internet, etc.), your password database is probably safe from Internet-based threats.

Note that I am not comparing local threats (involving physical access) here, because this is something that affects both options pretty much equally - you must have a local copy of your password database somewhere in order to use it, so you will be equally vulnerable to physical threats regardless of whether you use a cloud-based or local-only solution. That is not to say these systems are especially weak against local threats - protecting the database with a strong password and encryption algorithm largely mitigates this - but that one is not likely to be much better than the other in such scenarios.

In the case of LastPass and other cloud-based password managers, the attack surfaces and associated threats are much larger. Their systems are always on, and are very high-profile and high-value targets. If someone ever totally pwns LastPass, there's no telling what sort of systems they might find access to. While I'm sure they take their site security very seriously, they are likely subject to just as many attacks as any of the other user-trusted services that have been hacked recently. As the saying goes, it's not a question of if they will be hacked - just a matter of when. On top of that, you still have to worry about the security of your own system(s) which synchronize with LastPass.

Are LastPass or other clould-based solutions a tradeoff of security for usability, compared to locally-managed options such as KeePass? Absolutely. Is it worth it? That's for you to decide.

EDIT: To clarify on the issue of what is stored on their server.

They don't just store data for hashing/salting your master password on their server. Though that is an important, key piece of information to be worried about, the real concern should be that they need to store everything that you want synchronized between your devices on their systems. That is, if someone ever does hack LastPass and cracks your master password from their database, they will be able to access all passwords and other details that you have synchronizing between your devices without ever having to actually touch your own devices.

If you're looking to compare a cloud service like LastPass to a local application such as KeePass, then yes, there is a security tradeoff.

With an application such as KeePass, where you have full control over the storage of your password database (presuming you're not putting it up on DropBox or something), the only attack surface you have to worry about is your own system and the devices on which your password database is stored. Generally speaking, these are not likely to be subject to targeted attacks (or, as the media likes to call them, APTs). As long as you follow regular security best practices on your system (apply software updates, use antivirus, keep a properly configured firewall and/or router between you and the Internet, etc.), your password database is probably safe from Internet-based threats.

Note that I am not comparing local threats (involving physical access) here, because this is something that affects both options pretty much equally - you must have a local copy of your password database somewhere in order to use it, so you will be equally vulnerable to physical threats regardless of whether you use a cloud-based or local-only solution. That is not to say these systems are especially weak against local threats - protecting the database with a strong password and encryption algorithm largely mitigates this - but that one is not likely to be much better than the other in such scenarios.

In the case of LastPass and other cloud-based password managers, the attack surfaces and associated threats are much larger. Their systems are always on, and are very high-profile and high-value targets. If someone ever totally pwns LastPass, there's no telling what sort of systems they might find access to. While I'm sure they take their site security very seriously, they are likely subject to just as many attacks as any of the other user-trusted services that have been hacked recently. As the saying goes, it's not a question of if they will be hacked - just a matter of when. On top of that, you still have to worry about the security of your own system(s) which synchronize with LastPass.

Are LastPass or other clould-based solutions a tradeoff of security for usability, compared to locally-managed options such as KeePass? Absolutely. Is it worth it? That's for you to decide.

EDIT: To clarify on the issue of what is stored on LastPass' server...

They don't just store data for hashing/salting your master password on their server. Though that is an important, key piece of information to be worried about, the real concern should be that they need to store everything that you want synchronized between your devices on their systems. That is, if someone ever does hack LastPass and cracks your master password from their database, they will be able to access all passwords and other details that you have synchronizing between your devices without ever having to actually touch your own devices.

With a locally stored database, like KeePass uses, you don't have to worry so much about such attacks. That is not to say it would be impossible for someone to break into your KeePass database over the Internet. It's just much less likely they will be trying to, and it is a much easier threat for you to mitigate yourself. (Besides, if an attacker across the Internet can crack open your KeePass database - and you use the same system to log into the things for which the database holds passwords - you're probably pwned enough already that it wouldn't matter anyway.)

If you're looking to compare a cloud service like LastPass to a local application such as KeePass, then yes, there is a security tradeoff.

With an application such as KeePass, where you have full control over the storage of your password database (presuming you're not putting it up on DropBox or something), the only attack surface you have to worry about is your own system and the devices on which your password database is stored. Generally speaking, these are not likely to be subject to targeted attacks (or, as the media likes to call them, APTs). As long as you follow regular security best practices on your system (apply software updates, use antivirus, keep a properly configured firewall and/or router between you and the Internet, etc.), your password database is probably safe from Internet-based threats.

Note that I am not comparing local threats (involving physical access) here, because this is something that affects both options pretty much equally - you must have a local copy of your password database somewhere in order to use it, so you will be equally vulnerable to physical threats regardless of whether you use a cloud-based or local-only solution. That is not to say these systems are especially weak against local threats - protecting the database with a strong password and encryption algorithm largely mitigates this - but that one is not likely to be much better than the other in such scenarios.

In the case of LastPass and other cloud-based password managers, the attack surfaces and associated threats are much larger. Their systems are always on, and are very high-profile and high-value targets. If someone ever totally pwns LastPass, there's no telling what sort of systems they might find access to. While I'm sure they take their site security very seriously, they are likely subject to just as many attacks as any of the other user-trusted services that have been hacked recently. As the saying goes, it's not a question of if they will be hacked - just a matter of when. On top of that, you still have to worry about the security of your own system(s) which synchronize with LastPass.

Are LastPass or other clould-based solutions a tradeoff of security for usability, compared to locally-managed options such as KeePass? Absolutely. Is it worth it? That's for you to decide.

If you're looking to compare a cloud service like LastPass to a local application such as KeePass, then yes, there is a security tradeoff.

With an application such as KeePass, where you have full control over the storage of your password database (presuming you're not putting it up on DropBox or something), the only attack surface you have to worry about is your own system and the devices on which your password database is stored. Generally speaking, these are not likely to be subject to targeted attacks (or, as the media likes to call them, APTs). As long as you follow regular security best practices on your system (apply software updates, use antivirus, keep a properly configured firewall and/or router between you and the Internet, etc.), your password database is probably safe from Internet-based threats.

Note that I am not comparing local threats (involving physical access) here, because this is something that affects both options pretty much equally - you must have a local copy of your password database somewhere in order to use it, so you will be equally vulnerable to physical threats regardless of whether you use a cloud-based or local-only solution. That is not to say these systems are especially weak against local threats - protecting the database with a strong password and encryption algorithm largely mitigates this - but that one is not likely to be much better than the other in such scenarios.

In the case of LastPass and other cloud-based password managers, the attack surfaces and associated threats are much larger. Their systems are always on, and are very high-profile and high-value targets. If someone ever totally pwns LastPass, there's no telling what sort of systems they might find access to. While I'm sure they take their site security very seriously, they are likely subject to just as many attacks as any of the other user-trusted services that have been hacked recently. As the saying goes, it's not a question of if they will be hacked - just a matter of when. On top of that, you still have to worry about the security of your own system(s) which synchronize with LastPass.

Are LastPass or other clould-based solutions a tradeoff of security for usability, compared to locally-managed options such as KeePass? Absolutely. Is it worth it? That's for you to decide.

EDIT: To clarify on the issue of what is stored on their server.

They don't just store data for hashing/salting your master password on their server. Though that is an important, key piece of information to be worried about, the real concern should be that they need to store everything that you want synchronized between your devices on their systems. That is, if someone ever does hack LastPass and cracks your master password from their database, they will be able to access all passwords and other details that you have synchronizing between your devices without ever having to actually touch your own devices.