Keystone file + metamask will be much better,as the hacker will need to get your keystone to open your wallet,plus the metamask extension encrypts your private keys whenever you are doing transaction in some DEX or decentralized exchanges like etherdelta,forkedelta,idex so forth and so on,but it will be much better if you are using these two powerful things together with a hardwallet so that there will be no reason for your wallet to get hack.