How Safe is MetaMask?

[coinuser101]

I have become increasingly concerned with security considering all of the attempted hacks, scams etc..

Knowing this I have moved much of my funds out of exchanges, but now if I hold these funds in MetaMask, can someone initiate a payment without my consent?

I received a full-screen warning from MetaMask with a warning for Ethereum Phishing.

Picture below:

https://i.imgur.com/5rBFDmG.png

Keen to hear your thoughts

[sylance]

It's as safe as it can be having a third party access to your private key.  If you have more than $1000 in ERC20 tokens then it's probably a good idea to invest in a Ledger hardware wallet.  You'll still use MEW to access your tokens but your private key isn't stored anywhere on your computer so hackers can't get to it.

https://www.ledgerwallet.com/products/ledger-nano-s

[Heisenberg_Hunter]

If you have too much of tokens or ethereum, you could buy a ledger or trezor. But if you'r having low value, you could go for Metamask. Metamask is another hot wallet where the computer you are accessing is connected to the web. Metamask wallet is protected by the 12 word seed along with the password. If in case a hacker had connected to your computer some how, he should access your metamask wallet by writing down the password provided you have set the password.

Hence for you to minimize the risk to a larger extent, I would suggest you to store the seed phrase and password in a offline location. On the other hand, metamask is trying to implement the hardware wallet support in the near future. If the value is high, you need to absolutely store your eth and tokens in a offline location.

[luckybit1]

Metamask,i hard through a friend that it the best storage for now.He specifically downloaded it for me yesterday.... today as i was trying to access through the metamask it was loading slowing...I was like please let me manage my ethdalte . Am going to start using it some day.   

[cryptomorphines]

Safe asf,i have been using it for a year and it save my ass from getting hacked,few instances the metamask prompted me that i am entering a potential scam pr phishing sites,that is why i really loved this extension because it also protect the private keys when you are using decentralized exchanges like forkdelta or etherdelta,no need to worry it is recommended by the experts as well as the mew itself.

[dzelenyanskiy]

Using MetaMask is safe enough, but I recommend using the browser extension SimilarWeb, with which you can identify a phishing site, including a fraudulent MetaMask

[johnfitzwashere]

Metamask is definitely safer than sending your private key unencrypted over the internet. But as others have said, you are entrusting your keys to a third party.

Metamask is great for executing low value transactions and interacting with the blockchain. Its also open source: https://github.com/MetaMask/metamask-extension

[henryfekok]

Metamask extention is very safe i guess that picture of yours is the proof op. He stoping you to login or input any private information into phising site.

[flashmark]

So far I didn't see any complaints about security of MetaMask. Since you have a concern, better to use hardware wallet. That is the one of the safest method to store your tokens.

[kryptogunner]

if a significant money is involved, it is always safe to invest a little amount in hardware wallet to safeguard the larger sum. Atlest that little investment shall buy you a peace of mind and sound sleep. 

[kevoh]

Metamask is considered to be a good and safe option but it is still a hot wallet. Hot wallets are used when connected over the internet meaning it can be accessed remotely by a Hacker and keys could be stolen. Hackers are pretty smart people and if desperate can really do serious damage.

[dreamteam17]

I did not even try this method, so I will not tell you, but I would not be afraid so for hacker attacks, it seems to me they are taken only for big faces))

[Iamlegit4sure]

they all say metamask is very good and a very safe option to store your ethereum. but i' m not 100% sure. that is because i think you can still export your private key, and THAT's is how and when they get you!

[Nivelir]

I think that the MetaMask program actually has all the chances to protect you, for the most part people themselves are spending their opportunities for security. Hackers use human vulnerabilities.

[aborjin]

I think that metamask is safe only if utc is used.I mean, at least it's safer than myetherwallet.

[royalfestus]

I think that metamask is safe only if utc is used.I mean, at least it's safer than myetherwallet.

I may consider it to be a safe wallet but not safer than MEW.

[makuny]

metamask is so safe like your system. when your pc ist hacked so metamask is also not safe

[Msile]

If you want to use online wallet then MetaMask is definitely better than most options. But if you have large amount of crypto then better use hardware wallet. Because hackers are very smart. They can find loophole in any system and take your money away.

[cryptocue]

Very safe i cam using metamask for about 9months without any problem,protection from these phishing sites it is indeed the most powerful cryptocurrency browser extension,it is a 3rd party wallet which will protect your private keys from being stolen when you are using decentralized exchange so it is really necessary to have metamask.

[Will.Smith]

There are 6 ways to attack metamask:

With unlocked metamask

1. Your Last Outgoing Transaction Failed

A phony notification with real details about your last outgoing transaction

2. Sign For Your Last Incoming Transaction


You DONT'T EVER need to sign incoming transaction

A fake request to “sign for” your most recent incoming transaction, gathered from Etherscan

3. Cloning MetaMask’s CSS

A fake pop-out showing how easy it is so spoof the full MetaMask behavior

WIth a Locked MetaMask



4. Coercing the User to Unlock Their Real MetaMask

A fake notification encouraging a user to unlock their MetaMask

5. Phishing the User

fake MetaMask popout

6. The Timing Attack

As mentioned in this blog post by co-founder John Backus, the malicious site can wait in the background until it detects you have unlocked MetaMask in a different tab.

Full version of this article here