2

I wish to evaluate two different password security options which at first seem to be distinctly different:

  1. a cloud-based password manager
  2. a local (non-cloud) password manager

However, the twist is that the local password manager will be used with a browser add-on to give it functionality and convenience on a par with the cloud-based option. To make this comparison useful and practical, let's limit it to these two specific products:

  1. KeePass with Kee 2.0 (Firefox 57 web extension) with keepass-plugin-rpc
  2. LastPass (web extension version, Firefox 57)

Assume any potential threats lie entirely on the Internet side and that the local machine and local network are secure.

Are these two choices similarly secure in a general sense? The knee-jerk response may be to say that KeePass is more secure simply because it is not cloud-based (and we are assuming not threat from inside the local network or physical facility).

However, my question centers on the question of to what extent does using the Firefox addon with KeePass expose the entire password database to Internet-based attacks (of any type, including phishing -- anything that originated from outside).

I assume LastPass has had much more extensive security review and probably has a team of trained professionals keeping the whole thing secure.

On the other hand, the community seems to view KeePass favorably. But what about the Kee 2.0 Firefox add-on and the RPC plugin? Do those pieces have the same level of security review?

closed as off-topic by Hector, Stephane, ISMSDEV, Steve, Xiong Chiamiov Nov 21 '17 at 19:30

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • These are two very different products, KeePass is a local password manager, while Lastpass is a cloud based password manager. If you can't decide which one suits your requirements based on that aspect alone, nobody here can give you a useful answer as they're way too different to be comparable usefully. – Lie Ryan Nov 17 '17 at 10:37
  • @LieRyan My question seeks to compare these two products because I am specifically interested in the extent to which using the Firefox addon (Kee) exposes KeePass to vulnerabilities from the Internet. Technically, you cannot say that KeePass + Kee + Firefox is free of the cloud-based risks associated with LastPass – MountainX Nov 21 '17 at 23:33
1

That question is, unfortunately, mostly opinion-based. here is why:

Designing security is mostly about making choices between price, usability and security.

In your specific case, you're trying to offload that choice to "the community" (which, in itself, is a misnomer: "the community" doesn't exists any more than "the people" do). This cannot really work because, while everyone will agree on the "price" part, the balance between security and usability is specific to each case: I will not have the same requirement as you so while a specific choice might makes sense for me, it will not for you, for my father or for a coworker of mine.

The correct way to tackle this is first analyzing your situation: in your case, you have a number of potential tools that you want to use. for each combination, you need to identify the benefits and drawbacks in therms of security and usability. Once you have compiled that list, and that is the stage that no one but you can perform, you need to assign each of these items a weight. In the end, you factor these weights with each positive and negative trait and that will give you a good idea what your best choice is.

Not the answer you're looking for? Browse other questions tagged or ask your own question.