Bitcoin Forum

I have become increasingly concerned with security considering all of the attempted hacks, scams etc..

Knowing this I have moved much of my funds out of exchanges, but now if I hold these funds in MetaMask, can someone initiate a payment without my consent?

I received a full-screen warning from MetaMask with a warning for Ethereum Phishing.

Picture below:

https://i.imgur.com/5rBFDmG.png

Keen to hear your thoughts

It's as safe as it can be having a third party access to your private key.  If you have more than $1000 in ERC20 tokens then it's probably a good idea to invest in a Ledger hardware wallet.  You'll still use MEW to access your tokens but your private key isn't stored anywhere on your computer so hackers can't get to it.

https://www.ledgerwallet.com/products/ledger-nano-s

If you have too much of tokens or ethereum, you could buy a ledger or trezor. But if you'r having low value, you could go for Metamask. Metamask is another hot wallet where the computer you are accessing is connected to the web. Metamask wallet is protected by the 12 word seed along with the password. If in case a hacker had connected to your computer some how, he should access your metamask wallet by writing down the password provided you have set the password.

Hence for you to minimize the risk to a larger extent, I would suggest you to store the seed phrase and password in a offline location. On the other hand, metamask is trying to implement the hardware wallet support in the near future. If the value is high, you need to absolutely store your eth and tokens in a offline location.

Metamask,i hard through a friend that it the best storage for now.He specifically downloaded it for me yesterday.... today as i was trying to access through the metamask it was loading slowing...I was like please let me manage my ethdalte . Am going to start using it some day.   

Safe asf,i have been using it for a year and it save my ass from getting hacked,few instances the metamask prompted me that i am entering a potential scam pr phishing sites,that is why i really loved this extension because it also protect the private keys when you are using decentralized exchanges like forkdelta or etherdelta,no need to worry it is recommended by the experts as well as the mew itself.

Using MetaMask is safe enough, but I recommend using the browser extension SimilarWeb, with which you can identify a phishing site, including a fraudulent MetaMask

Metamask is definitely safer than sending your private key unencrypted over the internet. But as others have said, you are entrusting your keys to a third party.

Metamask is great for executing low value transactions and interacting with the blockchain. Its also open source: https://github.com/MetaMask/metamask-extension

Metamask extention is very safe i guess that picture of yours is the proof op. He stoping you to login or input any private information into phising site.

So far I didn't see any complaints about security of MetaMask. Since you have a concern, better to use hardware wallet. That is the one of the safest method to store your tokens.

if a significant money is involved, it is always safe to invest a little amount in hardware wallet to safeguard the larger sum. Atlest that little investment shall buy you a peace of mind and sound sleep.  :D

Metamask is considered to be a good and safe option but it is still a hot wallet. Hot wallets are used when connected over the internet meaning it can be accessed remotely by a Hacker and keys could be stolen. Hackers are pretty smart people and if desperate can really do serious damage.

I did not even try this method, so I will not tell you, but I would not be afraid so for hacker attacks, it seems to me they are taken only for big faces))

they all say metamask is very good and a very safe option to store your ethereum. but i' m not 100% sure. that is because i think you can still export your private key, and THAT's is how and when they get you!

I think that the MetaMask program actually has all the chances to protect you, for the most part people themselves are spending their opportunities for security. Hackers use human vulnerabilities.

I think that metamask is safe only if utc is used.I mean, at least it's safer than myetherwallet.

I may consider it to be a safe wallet but not safer than MEW.

metamask is so safe like your system. when your pc ist hacked so metamask is also not safe

If you want to use online wallet then MetaMask is definitely better than most options. But if you have large amount of crypto then better use hardware wallet. Because hackers are very smart. They can find loophole in any system and take your money away.

Very safe i cam using metamask for about 9months without any problem,protection from these phishing sites it is indeed the most powerful cryptocurrency browser extension,it is a 3rd party wallet which will protect your private keys from being stolen when you are using decentralized exchange so it is really necessary to have metamask.

There are 6 ways to attack metamask:

With unlocked metamask

1. Your Last Outgoing Transaction Failed

https://cdn-images-1.medium.com/max/1600/0*yFWDNd0QmYej1BtP.


2. Sign For Your Last Incoming Transaction

https://cdn-images-1.medium.com/max/1600/0*_LnZjDg2YoLt5ike.
You DONT'T EVER need to sign incoming transaction


3. Cloning MetaMask’s CSS

https://cdn-images-1.medium.com/max/1600/0*Es57j_ze0LXe6tbC.


WIth a Locked MetaMask



4. Coercing the User to Unlock Their Real MetaMask

https://cdn-images-1.medium.com/max/1600/0*VAohYHYJ7UWwC4kr.


5. Phishing the User

https://cdn-images-1.medium.com/max/1600/0*PUzbxlf3tQZeAehg.


6. The Timing Attack



Full version of this article here (https://blog.hellobloom.io/6-ways-a-site-can-attack-your-metamask-190e6651e400)

This warning only informs you that the page you visit is marked as scam so you shouldn't worry about that. I'm using metamask long time and don't have problems with it so you can use it as well. But if you have more money to spend then buy ledger. It's more safe than metamask :)

Is one of the best ethereum wallet in the space, so many people don't appreaciate it because their interface need to be imporved, I think the team focus mainly on security which is what the team is mainly focus on ahead of interface. It is good and safe and has save alot of people from losing their money

I have been using it for months without any problems,been saved 3x from phishing sites because it was blocked by metamask extension,while you are using decentralized exchanges your private keys will be protected by the metamask,do you wont need to worry about your keys being stolen from these echanges that is why it is really recommended by the experts.

I constantly use this extension. I consider that it is very convenient and could well protect your funds. But you still need to be very careful even using the extension

metamask is very safe and easy to use. just don't fall for the phishing attack and just secure your private key and you are all good. also consider using mew wallet, the UI is very good and easy to use.

metamask is safe as you protect it also but i sugest you to buy a leger nano s if your fund is morethan an thousand dollar.this is safest of them to protect your coins.

Good article.
However, the described methods of hacking are applicable absolutely to any service/site and are based on the user's inattention (and ignorance of the basics of web surfing security). I hope that most of the forum users do not relate to such.
I have not heard of any cases of breaking a Metamask. And you?

Install metamask extension and you will be safe from these phishing sites,i have been using this extension for years without any problems it is your own browser protections,acts like a barrier when you are using decentralized exchanges,protection from phishing attacks do not worry it is very safe and easy to use,also get hardwallet for more secured wallet.

 I encourage users to not use MetaMask to store more than they are willing to risk to a hacker, for longer than they need to, and that's the same for any internet connected signer.This is usually considered less secure, because if a machine is on the internet, it could be accessed remotely, and keys could be stolen.

Its safe as long as you have downloaded the legit extension,myetherwallet is also recommending this extension to be use togetther with their mew wallets or some hardwallets like ledger nano s or trezor for you to have more secured wallet,im sure if you got these things you will be 99% safe from viruses and malwares plus these phishing sites.

Wont be that complicated if the user isnt stupid to use other extensions or install malicious applications,what would you recommend if the reputable metamask isnt  secured? do you have any other alternatives? you shouldnt be saying its unsecured because you dont have proofs that there are some hack incident with using metamask extension,only those fools who will give their seed phrase would get hacked.

Its safe,but it is safer when you are using metamask extension together with hardwallets like ledger and trezor surely you wont be hacked and those phishing sites wont get your keys as it is built in your hardwaer wallets,i prefer ledger nano s because it is cheaper not bulky like trezor but i can assure you wil lbe protected from the phishing sites because metamask is blocking malicious websites.

Unlike Jaxx, MetaMask stores your seed phrase encrypted with your password, so there's have a slight advantage in that an attacker with full access to your computer would also need you to have MetaMask unlocked to have a chance of using your accounts.  They plan to implement hardware wallet support, and other offline signing strategies, but it's advised not to use MetaMask for longer than you need to.

Hope this helps  :)

It is hard to say and there is no way of knowing at the moment as I have not heard of any hacks. When I use decentralized exchanges I have a special wallet for that…I transfer coins from main wallet to secondary wallet, and sell from there. I do not even use metamask (I know there are more fees this ways, but at least you are somewhat safe

Metamask is great thing i love it its secure as much are all other wallets .you just need to backup and secure all your keys and password

As far as i know there are no issues from the millions of users of this extension,even me doesnt have any issues regarding to this good extension,its an extra layer of protection when you are transacting to decentralized exchanges it prevents these phishing sites to get your private keys.Better you use ths together with the hardwallets for you to be sure that you wont get hacked.

Very safe,because i have been protecting with this extension from the phishing sites just yesterday it prompted me that i am entering potential phishing sites that is why i loved this extension,powerful and secured enough to protect our private keys when we are browsing into decentralized websites or exchanges.

I have been a user of metamask, and i can assure you this extension will save your ass from phishing sites so you should use it together with your hardwallet so that these hackers wont have any chance to steal your private keys,because you are safer than ever with malwares viruses and phishing sites out there.

I never heard about that too. As far as i understand about metamask work in the different system compared with online wallet just like MEW. You must login to your metamask account through your password or seed phrase. My friends are using it to keep their amount and it's never getting any problem.

I have been using it since one year and it save from getting hacked, I really loved this metamask extension because it also protect the private keys when you are using decentralized exchanges like forkdelta or etherdelta.

Metamask is safe wallet where you can stock your funds. In fact, Metamask is much safer and secure than MyEtherWallet because it requires confirmation before accessing your wallet unlike MEW that only uses private key to access. There are so many fake sites of myetherwallet nowadays so when you sign in your private key there is a possibility that you will be scammed.

I've been using metamask for almost 3 years already and so far so good. Phishing is everywhere therefore if you fall victim to it then metamask is not to blame instead you were to blame.
We are responsible in avoiding this kind of mistake.

The warning that Metamask has given to you seems a very useful one. You may actually have visited a phishing site. If you have funds that you are afraid could get stolen I too warmly recommend you a hardware walled like Nano Ledger.

Yes your wallet is so much safe if you use metamask. And its more easy to unlock your wallet using this.

it seems to me not very safe, I do not trust this kind of purses, better ledger nano, or just a local purse on myetherwallet, it's up to you, but the security issue now has to be approached very responsibly

Thanks a lot. Because of this article I will save my money. I heard about this issues but wanted to know how to prevent those. I will use only "clean and empty" computer for the transactions in the future. It's not guarantee but more chances to avoid these malwares.

To me, you should use Metamask because it creates a private key-pair via a seed and is accessible through the web browser. So you can completely control of their private keys, which can be used to access funds anywhere.

That's maybe you entering phishing sites. Metamask has a function to warn users while entering phishing sites. That a usual thing with Metamask.
I suggest you bookmark all your visited site, including Myetherwallet and all your trading sites.

To my knowledge, it will be a good choice for you when you choose to Metamask to use because MetaMask enables you to participate on EtherDelta, a decentralized exchange, directly from the wallet. You don’t have to deposit or withdraw funds on the exchange, but rather the website communicates with the MetaMask extension and enables you to trade on the spot.

It is so good if you choose Metamask to use because it allows you to keep any ERC20 Token in the same wallet, as well as allow you to easily view your account on the Ethereum blockchain. So convenient and easy to use.

i have wallet in MEW, can i use metamask for my same wallet address from MEW?or have a new one with meta mask?

MetaMask is the super safe way in entering on your ethereum wallet. It is the best way indeed. Try using it it is really safe guys. I don't know how it actually works but a lot of people using it doesn't seem to state problems regarding the metamask.

To me, you should use Metamask because it creates a private key-pair via a seed and is accessible through the web browser. So you can completely control of their private keys, which can be used to access funds anywhere.

metamask have some problems like cannot estimate gas; transaction may fail or may require manual gas limit https://fundlan.com/cannot-estimate-gas-metamask/ (https://fundlan.com/cannot-estimate-gas-metamask/)
but is very good.

I don't had a very good experience with metamask. There are airdrops and phising links, that made you click and once you do, its game over. All your funds from metamask are gone. And there are so many of these attempts that one falls for it, no matter how cautious he is.
My advice is keep your funds in a wallet but don't add it to the metamak and dont keep it on the laptop u use. Keep it somewhere safe and only add it once you need the funds and then remove that wallet.
Keeping a separate laptop for these kind of these things would be better.

In this case I would say that Metamask is a safe wallet but most of the time we do it like we connect our wallets with fake websites which makes our Access in and then they hack our or specific chain or whole wallet .
so always  connect your wallet with real website  and don't connect with random  fake website that we get scam and  danger   even if anyone connects his wallet to fake website so do Revoke is that your wallet disconnected to that website  your secret phrase are save in safe place.
 don't share anyone  so your wallet will be safe.

Metamask is safe and I am using metamask extension in chorme browser for a crouple years, nothing faced any issue. But i do not suggest to use for big amount holding in your wallet. You should buy hardware wallet to protect your large amount, because if somehow you clicked any phishing link or site then hacker can control your pc.

Metamask is safe for small amounts of resources.  If you have a lot of tokens or ETHEREUM then you can use hardware wallet.  such as  ledger or trezor.  Metamask is an online wallet that you access through your computer connected to the web.  You can access the MetaMask wallet by entering your 12-digit seed code and setting a password.  But it should be noted that only use metamask for small amount of assets, if you have a lot of assets then hardware wallet is very safe.

Metamask is safe. It's more upto us how we make our browsing habit safe. I don't think some website could just auto approve themselves, but you need to be careful to what website you are giving your approval. There are many way scammer tries to phis your coin out. They may insert a scam url even though you are moving between valid urls. They feed you real looking scam sites, sometimes they come first in google search. Another thing is they target your device with malware that reads, modifies clipboard and keystrokes and sometimes one's that even record and transmit your screen. So, you should make it sure that you're accessing Metamask in a secure device.

Metamask is very safe but only for a small number of resources . There are numerous traders or holders, People  use metamask because they have less resources. There is no requirement to use a hardware wallet. So I would say for less resources you can safely use metamask.

It has always been advised not to hold your assets in exchanges. it is a very risky venture to do so.
As for metamask, I have been using it for years and I have had no security isssues using them. I speak for myself though, someone might have a contrary opinion.

The space is filled with volatility, we just have to be careful when dealing with the system. Metamask is a reliable exchange, atleast I've withdraw my gigantic profits from the system, not holding back from making good chance of earning. What I can be confident of are crypto related exchanges that I've used and not the ones mentioned on board. I can sense that most of these exchange are overhyped, they don't stand any solid chance of exploring to become better opportunities for most of these investors.

Yeah. Metamask is reliable and I rarely hear anyone talk about having issues with them. Although some newbies who do not understand how to use it may not really like it. Initially, early in my crypto journey, I didn't really like using metamask, because I didn't understand a thing about them. But as time progresses I have been using them a great deal.

Yes it is possible for anyone to initiate a transaction without your consent on metamask or any wallet, especially if your private key has been compromised, particularly through phishing attacks. If you suspect that your private key may have been leaked, it is advisable to transfer your funds to another wallet promptly to ensure the security of your cryptocurrency. In my opinion, metamask is one of the safest online wallets available, but the responsibility ultimately lies with the user to exercise caution and avoid potential hacking risks.

Meta mask.  Secured from all sides but it disappeared from the wall a few days before me.  I don't understand why this happened, maybe someone fixed it as mine or I am a third party phishing site.  I have read it.  How can I free myself from this?  I have a lot of means pretty much hacker now but I haven't put everything online I can do everything I can start it but sometimes dollars disappear from my all.  I can get a lot out of this if anyone can help me in any way it would be great.  A few days ago I almost.  Like $63 is gone.

MetaMask is the simplest wallet to use, but like other wallets you have to follow security practices too. Try to save the password manually along with the password correctly. If not, there will be a lot of people trying to get into your account if they randomly track a wallet address which happens to be yours and has a lot of content in it. Must be careful.

Same for me because I have been using it and sent and received huge amounts of ETH already from it and there were no problems encountered by me but that does not mean that others have the same experience as well because most users' recommendations are not these kinds of wallet rather a hard wallet that only you who have the full authority to control it. Let's just say if you don't have any alternatives or you have not bought any hard wallet yet, you can always use it just like others using Electrum for their alternative Bitcoin wallets since they don't have enough budget to buy hard wallets yet.

Yeah. Hard wallets are the best bet. But not everyone can afford to get a hard wallet.
There are people using these custodian wallets like metamask for years and have never had any issues with their wallets. Most times, problems normally arise if your seed phrase is exposed, it makes it easy for your wallet to be compromised.

It's been quite good so far using Metamask. However, this is not recommended when using it for long-term investment, in the sense that we want to hold many sets in Meta Mask for a long time. No matter how safe it is, online wallets still have risks in various ways. These risks can be in the form of hacks, phishing links, malware, and also several other online wallet problems that can have fatal consequences for our assets. Therefore, if you want to store assets for a long time and with a large amount of nominal value, I personally would recommend hardware wallets. This is much less risky. Unless it's only temporary or for a specific purpose, maybe Metamask functions well and is very helpful, especially when we connect it with several DEXes.

If your assets are already large, you should self-custody using Trezor or Ledger. Warning first, this is not a sponsor or anything, I'm just giving advice because we have 100% full control over the assets we have. You have to learn that if your assets are already large.

Metamask is a good swallow to wear during use, if you have questions about safety it all depends on yourself. How to take good care of it is not easy, as bounty participants may be familiar with the busy world of airdrops. and Don't easily connect our wallet to the Airdrops site, which means it's not easy because many wallets are lost, which is a key effect

I keep most of my assets on exchanges and a small part in my personal wallet, but so far I haven't encountered any significant problems either. If you save it on an exchange, save your password carefully and use all the double security features, if you save it in a personal wallet, save your recovery password carefully and don't connect your wallet to any site.

In terms of privacy, it's not safe. They will collect your data if you use their default RPC provider. Read through this thread (https://bitcointalk.org/index.php?topic=5423015)

   In over a year of using metamask, I haven't had any problems with this apps wallet. Because I don't put a lot of value on metamask either. Then if you are sure of what you are doing in metamask and you are sensitive to the actions of hackers, for sure you will not fall victim to those exploitative people.

   But what others are saying is right that it's okay to use it as long as you don't put a large amount into the metamask, but if it's a large amount, it's really recommendable to use a hardware wallet rather than software wallets like that.

I think Metamask is one of the best for now. Your picture is the proof that Metamask always protects you in your transactions. He said that the page you visited was marked as a malicious website based on their data. I recommend continuing to use metamask rather than being naked with your private key, obviously that is more dangerous. To store assets, I suggest you create a new wallet using MEW, and only use metamask for transactions by importing your wallet via metamask. Creating a wallet with metamask is a bit risky when other people know your key phrase and password. Having a lot of ETH, maybe buying a hardware wallet is safest.

So have you ever had problems when storing assets on an exchange? If yes, you should also tell it.
sometimes they keep their assets on the exchange because they do day trading or short-term investments. This is done to save costs, because if they make deposits and withdrawals all the time they lose a lot of costs.

This has been tackled up in a lot of discussion that its never good to store your asset on exchange since there might issue to rise and your asset will be in trouble if scam happens.

For now you might not experience yet those issue but remember that FTX is a reputable exchange before but unfortunately they became scam and put a lot of their platform user in trouble, That's why its important to know about Not your keys not your coins keyword so that you will always be aware on this matter and move on possibly your funds to exchange then locate those wallets that you can truly trust the more. Metamask is good platform but we don't know on when they might encounter a issue so they need to do good decisions about this.

Your concerns about security with MetaMask are valid, especially given the rise in attempted hacks and scams in the crypto space. While MetaMask is a popular choice for managing Ethereum and other tokens, it's crucial to remain vigilant and take necessary precautions to protect your funds.

Regarding your question about unauthorized payments, MetaMask does offer robust security features to prevent unauthorized transactions. However, it's essential to ensure that your MetaMask wallet is adequately secured with a strong password and, if available, two-factor authentication (2FA).

The full-screen warning you received about Ethereum phishing is a testament to MetaMask's commitment to user safety. This warning indicates that MetaMask is actively monitoring potential threats and taking steps to alert users to potential risks.

In addition to relying on MetaMask's built-in security measures, consider practicing good security habits such as avoiding clicking on suspicious links, double-checking transaction details before confirming, and keeping your MetaMask software up to date with the latest security patches.

Your fear is very natural
I think about hacking etc.
usually it can't be avoided by us because there are most heckers who are used to doing things like that.
without having to log in without having to wait for our approval it can be done by heckers.
But what I know about metamask is that there is a guarantee of safety, especially since metamask has become a popular tool for payments etc., in crypto.
but also on the other hand we must also be careful and maintain security measures about metamask.
and not trust just anyone even if that person is our closest friend.

Exchange wallets are custodial wallets and metamask is a non-custodial wallet. Storing your assets on an exchange means you are handing over your assets to a third party who has the private key to your wallet. Exchange wallets are not completely under your control. It will be a problem when something happens to that exchange. Therefore although metamask does not provide you high security like ledger, but at least it is much safer than storing in exchange wallets.

of course it's safe, I've been using the metamask extension since 2016 or 2017, I forget, so far there haven't been any problems, it seems like a lot of metamask wallets have been hacked, drained, coins lost purely due to user error, whether he clicked on any link, swapped foreign coins that arrived - suddenly appears in his wallet, or other errors. If the user understands basic and advanced knowledge about personal data security and cyber crime, I think cases of asset loss on Metamask will never happen, but it comes back to the individual.

How Safe is MetaMask? ummm.... at least metamask is safer than storing it on an exchange like binance, kucoin, or other exchanges. or if you want more security and comfort, buy a hardwallet like the Trezor Model T, Ledger, NGRAVE ZERO, KeepKey, and ELLIPAL Titan or whatever hardwallet you trust to store your valuable crypto assets. If you want it to be simple, I still recommend Metamask. I myself use metamask for all my assets, so far I have never been hacked.

There are a lot of scammers who stealing the passwords, very often people give the passwords by themselfs.

I do that, just save some of the money needed for trading on the Exchange in the short term and withdraw it gradually when I make a profit, this will save costs rather than having to make deposits and withdrawals continuously. There will be a certain period of time to start withdrawing.
I also use metamask and it is quite safe, but it depends on how the user is. because many phishing are trying to connect.

And for hackers to have access to your wallet, maybe you have show your private details with somebody in the community because many altcoins investors are still using this potential wallets for long term hodling and short term hodling with confidence. If hackers can get to your token through your phone or laptop, I think you save your seeds phrase in that particular phone or laptop that make the person to take the advantage to display all those things to your wallet. I have be using metamask wallet over some years, and I have never experience any challenges from my token anytime I check and they are well safe in the wallet.

It's Metamask phishing, you should be careful and avoid when you find a website like that because your funds or your information could be stolen from you without any notice. We can encounter lots of websites like that when we looking for free Airdrop because not every Airdrop is trusted. I once got this phishing on my Metamask wallet in the end all my funds were transferred to an unknown wallet. As long we're not making mistakes I guess it's fine.  

Yeah. For long term assets, mostly hardware wallets are adviced for obvious security reasons.
Online wallets have their attendant risk and like it's said, better to be safe than to be sorry.
And also, most people keep their assets in online wallets so that they can qualify for certain airdrops.

Well, some people do keep their assets on centralized exchanges, but it is not really the best decision.
Keeping your assets in a cex is like keeping your money in a conventional bank. They can wake up tomorrow and place a limit on how much you can withdraw from your acct.

---

Personally I haven't had any major problem holding my assets in an exchange except for one time I deposited a token to an exchange unknown to me that withdrawal of that token has been suspended. I wanted to send to other wallets from the exchange.
Yea, people keep the assets on exchanges because they trade with it, it saves time and money to do so.

Any software cryptocurrency wallet will not protect you from viruses or exploits. I have been using Metamask for a long time, but only in conjunction with a hardware wallet. And for testing projects or for wallets with amounts up to $100, I do not use a hardware wallet. You can create many wallets in Metamask and it is very convenient.

Metamask is safe base on how you used it, at the first stage is to create the metamask wallet account by save the phase code and private of the primary wallet of the account, which you can create many wallets with a different private key in one account and one is to be careful not to connect your wallet in website as a name of claim token and airdrop is easier to be hacked by wallet connection with phishing link's

Storing assets in Metamask is very risky in my opinion because we have to be extra careful when using it, don't press the link carelessly because it could be a phishing link. I recommend that if you have quite a lot of assets, start self-custodial or buy a cold wallet because cold wallets have security. extra

also, hardware wallet doesn't always guarantee safety remember the exploit that was introduced by certain hardware wallet back then because some hacker trying to upload malicious code to the library owned by the hardware wallet producer if im not mistaken it caused certain problem that allows the hacker to steal money, i think that should be concern, at the end of the day its always better to generate address from a computer thats not connected to outside network for the sake of safety if its for long term holding, if its for interacting with dapps, i think metamask will suffice, they have introduced many measure to prevent people from executing malicious smart contract that allows the stealer to get approved access to the token in the wallet.
but it still comes down to individual how responsible they are in managing their own address after all, anyone can disregard the warning from the wallet itself and go on executing malicious contract because they are blinded by greeds.

Metamask was created to make it as easy as possible for users to carry out every transaction without experiencing problems. So far I have used Metamask in safe situations and have been cheated because of my own mistake, by accepting a link given by someone where I was asked to connect to Metamask, all my assets were taken. after that it didn't want to accept any links I received from anywhere and connected to metamask.
So the main problem is not the wrong wallet itself but the behavior of the wallet holder who cannot maintain it.
If your suggestion [cold wallet] is of course the best choice of all wallets, but if our transactions are small it's better to just postpone it.

Metamask is not without flaws, any security breach can become a serious problem for you. You need to be especially careful when linking wallets to third-party resources, access to the wallet is very easy to obtain through phishing links. Hardware wallets are the safest way, but sometimes not as convenient as metamask when you need to dynamically carry out trading operations.