I read the upgrade notice today in my browser regarding Kee 3.0 with great disappointment. After trawling through many posts here, I see most of my concerns have been voiced already. But I thought I’d add my voice to the list of dissatisfied (ex-)users.
People using KeePass already are the sort of person who don’t want a cloud-based offering like 1Password or LastPass. It’s surprising that you’re re-branding your product that has been serving these kinds of customers to be, by default, a cloud-enabled offering. It doesn’t matter that the data is also stored locally, that it’s only ever uploaded encrypted, etc. If people wanted that, they’d already be using one of those other services.
I would wager that the vast majority of people using Kee already use KeePass in a disconnected fashion, or use some other service to sync password files around - Dropbox, OwnCloud, NextCloud, an SMB/CIFS share, NFS share, etc. It’s not clear to me that Vault provides any sort of advantage over these solutions except to add a potential man-in-the-middle vector that is hard to audit unless I’m willing to compile my own copy of your new plugin, assuming it’s even open source.
Your messaging is misleading and unclear, even with the re-wordings over the past few weeks. I had to dig through the forum here to understand that the 3.0 plugin didn’t already upload my password file, and that it wouldn’t do so without my explicit permission (and after signing up for your new service.) That’s a huge trust violation. For instance, because I work extensively with EU data, GDPR is a critical concern for me. Your plugin’s terms changed so drastically that I started having to write up a disclosure notice to my clients before realizing that no data had left my system! (Your Vault product might not even be GDPR compliant. Do you have a Data Processing Addendum ready for EU customers? You probably want to look into that.)
I did my due diligence and realized that it’s basically just you ( @luckyrat ) behind the entire extension and this new offering. I have increasingly lost faith in one-person projects, especially when they turn commercial as yours has. I don’t begrudge the paid-open-source model, or the SaaS one, but without the transparency of a group of individuals behind an effort like this, independent security audits, etc. I can’t even begin to consider to use such an offering - notwithstanding my misgivings about cloud-enabled password management.
It would be hard for you to gain back my trust at this point. About the only thing you could do would be to split your plugin so that there remains a traditional, local-only Kee plugin that I can 100% prove to myself (e.g. by reading the source code) doesn’t surreptitiously upload my password file in the background, encrypted or not.
If you hadn’t taken this strange route, and had communicated it more clearly, Kee 3.0 with a new checkbox to enable Kee Vault support that came disabled by default, even with a “Sign up now!” button (opt-in) wouldn’t have raised my hackles.
I’m now running KeePassXC and the KeePassXC-Browser plugin instead. As these are group-developed projects, 100% open source, and committed to local storage of data as a primary objective, I feel more secure that they have my personal best interests at heart.