To clarify - it is not safe to forge with the online wallet, correct?
Correct
why it's not safe?
Because any remote wallet is hosted by "someone" and you should not trust it.
1.
http://wallet.elasticexplorer.org/ is hosted by me. I secured this node as much as I could, but I can't promise you that this node is 100% secure.
2.
https://wallet.elastic.pw/index.html is hosted by @byrallier. I don't know anything about this node.
I can safely assume that if you're using Windows and you know that there is no exploits/viruses/trojans/malware on your machine it's always better to use our Windows binaries (
https://talk.elasticexplorer.org/t/windows-wallet-release-3-1-0/546) than some online wallet.
is hosted by @byrallier"). I just checked them and they hav both started FORGING without my activation... Is this normal?