How secure is Kee 2.0 (Firefox 57 addon) with keepass-plugin-rpc compared to LastPass? [closed]

Question

I wish to evaluate two different password security options which at first seem to be distinctly different:

1. a cloud-based password manager
2. a local (non-cloud) password manager

However, the twist is that the local password manager will be used with a browser add-on to give it functionality and convenience on a par with the cloud-based option. To make this comparison useful and practical, let's limit it to these two specific products:

1. KeePass with Kee 2.0 (Firefox 57 web extension) with keepass-plugin-rpc
2. LastPass (web extension version, Firefox 57)

Assume any potential threats lie entirely on the Internet side and that the local machine and local network are secure.

Are these two choices similarly secure in a general sense? The knee-jerk response may be to say that KeePass is more secure simply because it is not cloud-based (and we are assuming not threat from inside the local network or physical facility).

However, my question centers on the question of to what extent does using the Firefox addon with KeePass expose the entire password database to Internet-based attacks (of any type, including phishing -- anything that originated from outside).

I assume LastPass has had much more extensive security review and probably has a team of trained professionals keeping the whole thing secure.

On the other hand, the community seems to view KeePass favorably. But what about the Kee 2.0 Firefox add-on and the RPC plugin? Do those pieces have the same level of security review?

Answer 1

That question is, unfortunately, mostly opinion-based. here is why:

Designing security is mostly about making choices between price, usability and security.

In your specific case, you're trying to offload that choice to "the community" (which, in itself, is a misnomer: "the community" doesn't exists any more than "the people" do). This cannot really work because, while everyone will agree on the "price" part, the balance between security and usability is specific to each case: I will not have the same requirement as you so while a specific choice might makes sense for me, it will not for you, for my father or for a coworker of mine.

The correct way to tackle this is first analyzing your situation: in your case, you have a number of potential tools that you want to use. for each combination, you need to identify the benefits and drawbacks in therms of security and usability. Once you have compiled that list, and that is the stage that no one but you can perform, you need to assign each of these items a weight. In the end, you factor these weights with each positive and negative trait and that will give you a good idea what your best choice is.