It's all common sense, guys. The only way that they'll get your password is if you basically give it away, and by that means getting duped into going into sites where you think it's legit. I had one of those happen the other day, someone messaged me with what looked like a legit steam site (at least from the link, I didn't go in), until I saw .tk at the end.