Both solutions leave your secret key under your control.  In theory.  I use blockchain.info because last I looked Multibit required a Java install which is not available for my secure platform and which I don't even feel comfortable installing on my non-secure Windows machine.  To much bloat, opacity, and weirdness with that framework for my tastes.  I'm not a frequent Bitcoin user and hope that if blockchain.info's JS infrastructure is compromised, someone would note it in code before I got screwed.  I don't think I've done a transaction since the selling opportunity early in the year, though, and have not kept up on things lately.