@steemapp: regarding security, as raised by @cryptos, are you asking for the master password that controls the account or only the posting key? Mobile phones aren't the safest platform around and there are plenty of apps that contain malware. For security reasons, it would be better if Steemy was working exclusively with the posting key / password and active key / password of users so that no matter what, it wouldn't be able to hijack Steem accounts even if it tried to. That's the best way to stay clear from most of the liability that comes with running a crypto-currency app for mobile phone. Of course, there is the problem of how understanding users are about the difference between master password / key and more specific access keys, but there is a way to make that pretty transparent for users. See below.
@dantheman: it would be good to have in the protocol something like "access requests" that would allow anyone to ask for a specific public key to be added as authenticating key of another users account. These requests would just sit there waiting to be approved or denied by a client that has control of the target user account. Typically all that the target account client will have to do is read the requests, display a pop-up "do you want this key to have <posting/trading> access to your account (yes/no)" and perform a update_accout_auth_key call to add the key to authorized keys for the specific type of permission. For security / foolproof-ness, this third party request mechanism shouldn't apply to "owner" permission. The point of doing that is that app developers can have their app request for permissions very much in the same way as third party Google apps or Google Drive apps are requesting the authorization to access one's Google account. Doing so, the user never needs to input his master password / key in the (somewhat untrusted) third party app: all she needs to do is tell the app what is her Steem account, then go to Steemit.com, authenticate with her master key, and approve the app's request. That way there is no way for any third party apps to hijack accounts. So long as users are careful about what specific authorization they give to the app, in the very worst case the app may post / vote on their behalf (and get spotted very quick) or steal some liquid Steem / SBD but most of the funds in the form of vests would be safe and can be easily protected by terminating the app's access / removing its keys.
Hey @recursive, sorry for the late response, things have been crazy over here for us and we've been nose to the grindstone so we can get this into people's hands asap.
We will give the user the option to use whichever password they are most comfortable with, whether that is their master password, or one of their other keys. The exact user flow for the final product is something we are still working on, but our intention is to create a user flow that recommends the user login with their posting key only.
@steemapp: I'm referring to the debate there was in steemit.chat . Understand that allowing people to use their master password is raising a huge red flag. You don't need the master password for posting. Why ask for it or even allow people to give it and at the same time jeopardize the security of their entire account (you know smartphones are unsafe, don't you?). I'll personally (and this won't be only me) will be putting disclaimers in each and every of your posts reminding people of the security risk of using their master password on their smartphone, of the fact there is no way to really know what you app does, and of the fact they could lose entirely their account. But if you don't ask for the master password and instead encourage people to manage intelligently the security of their account, I won't have any reason to make all that noise.
Beside, if you ask for the master password, many people will be challenging you for opensource release. I know opensource in meaningless in the case of smartphone apps which are anyway built and released on app stores that don't allow users to check signatures and checksums. But I know people will still ask you. You can easily avoid that, again, by opposing to them that you only ask for the posting key that can be replaced in a finger snap should people feel that the application is misusing their key.
For everyone's peace of mind, and to avoid you trouble, questions and accusations, please DO NOT "offer" the possibility for people to use their master password. There is now a "permission" tab in Steemit. If need be make a quick tutorial animation to show people how to get their posting key and put it in your app.
This is the one and only issue that makes your app cross my alert threshold. And again that's not only me annoying you, you'll get heat from every direction if what you do risks compromising Steem users account security.