I've been reading a lot of people mentioning they have had their XMR stolen from mymonero. I'm not sure if they are falling for phishing scams or if the 13 words seeds are compromised on mymonero and I am worried. It seems as though mymonero hasn't received any updates since 2016 so I am also worried they might disappear and I won't be able to access my funds.
My questions.
Is MyMonero.com no longer safe?
If MyMonero.com goes down can I use my private key in the GUI or CLI clients?
While I don't know positively that mymonero.com is or is not compromised (I don't have any indication that it is), any web-based wallet is inherently unsafe compared with an official CLI or GUI based wallet. There are gradations of safeness one could say and a web-based wallet is on the very insecure end of the spectrum. On the top end would be a disconnected (cold) dedicated hardware wallet.
The good (and trusted) gentleman who runs mymonero.com advises not to store large amounts in the wallet. Basically, a good rule of thumb is: Only store as much money in a web wallet as you are willing to pay for the comfort of having a web wallet. Basically, only store as much money there as you are prepared to lose and don't come crying if your money is gone if you stored it in a web wallet.
As stated on the sign-up page of mymonero.com:
Understand the Risks in Using MyMonero MyMonero is a web-based interface that allows you to use Monero without running a full Monero node. However, because this convenience comes at a cost: it is extremely difficult for MyMonero to securely deliver its code to your browser. This means that there is considerable risk in using MyMonero for large amounts!
It is recommended that you treat MyMonero as you would treat your actual wallet, and not store very large amounts in it. For long-term storage of Monero you should create a cold wallet using MoneroAddress or similar.
A sobering and very enlightening reddit is here: https://www.reddit.com/r/Monero/comments/52sw9r/9830_xmr_stolen_from_my_mymonerocom_wallet_be/
The upshot is that the number of potential exploits that can be used to exploit a web wallet are tremendous and out of the control of the web service providing the service. This is in addition to the possibility of the web service itself being compromised and delivering faulty code.
Edit: There is a communication from fluffyponyza here about recent thefts from mymonero.com: https://www.reddit.com/r/Monero/comments/7kmzkv/psa_regarding_recent_reports_of_mymonero_thefts/
Also forgot to answer your second question:
If MyMonero.com goes down can I use my private key in the GUI or CLI clients?
Yes you can. You need your viewkey and spendkey and your address which you can get from the mymonero.com under Account => Account Details. You have to do this obviously while the site is alive.
Just start the Monero GUI, and after you have choosen your language click on "Restore wallet from key or mnemonic seed". Then click the "Restore from Keys" tab.
Put in your address and viewkey and spendkey keys and you are away.
