I wish to evaluate two different password security options which at first seem to be distinctly different:
- a cloud-based password manager
- a local (non-cloud) password manager
However, the twist is that the local password manager will be used with a browser add-on to give it functionality and convenience on a par with the cloud-based option. To make this comparison useful and practical, let's limit it to these two specific products:
- KeePass with Kee 2.0 (Firefox 57 web extension) with keepass-plugin-rpc
- LastPass (web extension version, Firefox 57)
Assume any potential threats lie entirely on the Internet side and that the local machine and local network are secure.
Are these two choices similarly secure in a general sense? The knee-jerk response may be to say that KeePass is more secure simply because it is not cloud-based (and we are assuming not threat from inside the local network or physical facility).
However, my question centers on the question of to what extent does using the Firefox addon with KeePass expose the entire password database to Internet-based attacks (of any type, including phishing -- anything that originated from outside).
I assume LastPass has had much more extensive security review and probably has a team of trained professionals keeping the whole thing secure.
On the other hand, the community seems to view KeePass favorably. But what about the Kee 2.0 Firefox add-on and the RPC plugin? Do those pieces have the same level of security review?