Staying safe with MyEtherWallet & Metamask

There are soooo many scams on slack channels - and way too many are aimed at getting you to go to fake MyEtherWallet web sites.

This is probably because of the fanatical effort put in by Kevin and Taylor to build an amazing online wallet that

Works in your browser (your keys stay on YOUR computer)
Has incredible community support (because it is so damn good)
Develops really fast to satisfy your every need (crypto related of course)
Doesn't cost anything to use
Is used by a huge percentage of the ethereum community

And, if you have ever inhabited a slack community you are bound to have received a message like this :

You may also get messages advising you to set up 2FA (which, were it not a scam, would be a joke because you never have to log into MyEtherWallet) or all kinds of other tricks to get you to go to a fake MyEtherWallet.

Some are really well disguised. Like this one :

I thought that there was a smudge on my screen - but I know not to click on links except to check that they are already reported in either Metamask or EtherAddressLookup.

All of these scams are trying to get access to the keys of your ethereum account. The same key that MyEtherWallet carefully ensures do not leave your own computer.

The best way to stay REALLY safe is to never even give your keys to MyEtherWallet (not even the real one).

There are two ways to do this - the cheap way and the not so cheap way.

The cheap way is to install Metamask. A cool in browser wallet with limited features.

Send ether
Call contracts IF YOU ARE AN ETHEREUM WIZARD
Inject Web3js into webpages

The second one is not easy. And while they show you your tokens, you can't send them from Metamask without satisfying the second condition (you need to be able to create ABI code)

But the third item allows you to use MyEtherWallet to send from your Metamask account - but you sign the transaction inside Metamask. Even a fake MEW cannot access your keys as long as you do not export them from Metamask.