I agree but according to the steemit documentation this is actually by design. Dtube, and other sites ask for it and apparently it is thought to be ok as it is just the posting key which is the "lowest level of access. I agree this is not a great idea. They apparently ask for it so that you can use their service which performs actions on your behave at your request. I get it but seems a little crazy to build it this way. At least the posting key does not have access to any of the money, but there just should be a better way. I will definitely need to look at the APIs and think on this. I totally agree with you @motivators private keys are supposed to be private which is why I thought it really odd that it is designed this way and even suggested in the guides and documentation I have read.