The https thing is unfortunate and should be fixed, but I've always got my KeepassX from a signed repo.
The cobbling together is also an important part of its strengths. In particular I want the sync of the encrypted DB to be decoupled from the app that decrypts and manages the password entry into forms (the latter being yet another entity, btw).
I'm really curious to see that FAQ entry! Because I can't imagine a scenario where timing sidechannel attacks would be relevant to a password manager app (provided the sync is decoupled, which is one reason why that's so important). If you're gonna bruteforce the master key, you'll use an external program any way, so constant time comparisons in Keepass's routines shouldn't matter? Also it's not like you could remotely trigger Keepass to decrypt 1000s of times in order to glean info from timing data, because it's not a browser plugin. Which is one of the reasons why we don't want our password manager to be a browser plugin. Again, decoupling is a strength.
- Sourceforge, again not ideal but again it has very old beginnings from when Sourceforge was as respected as Github is. You can't blame the developer for the environment changing. Perhaps they're just a stickler for loyalty. I've never had any crapware with Keepass
- FAQ - I could't find your reference in the FAQ page [1]
- You have one app + plugin with a browser extension from two developers, hardly a mishmash. You know directly who those two developers are. You've no idea who was working on LastPass. I'd say it was more in the bazaar philosophy vs the LastPass cathedral.
[0]: http://keepass.info/integrity.html
[1]: http://keepass.info/help/base/faq_tech.html [0]: https://sourceforge.net/projects/keepass/files/KeePass%202.x/2.35/KeePass-2.35-Setup.exe
[1]: https://chocolatey.org/packages/keepass
- No https on site
- Update file hosted via http (not https)
- Downloads via sourceforge which has injected adware in downloads before
- FAQ downplays lack of constant time comparison instead of using constant time comparisons and being extra safe
- You have to cobble together multiple apps from multiple developers to get a full working solution; means you have to trust lots of individual entities
That being said I can hardly defend staying on Lastpass anymore.
I just wish 1Pass was crossplatform so there was a clear universal winner!