This is an important issue. Active key is the key of our fund and safeguarding of it is necessary for us.

If @crypto.piotr posts their passwords I have no problem doing so, they have a lot to lose in cases of attacking us and very little to gain.

I am glad you addressed this concern. Thank you.

Thanks for the clarification.

Greetings @Piotr , Thank you very much for clarifying the doubts .
This sentence should clear a lot of doubts .
" the reason why Steemlogin requests your active key is to execute this contract between you and our application, also known as signing the transaction for authorization."

It is very important to know this.....

Thank you for this important information @crypto.piotr

This is the first of your publications that I read. And I see that all of them are extremely interesting.

Thank you for sharing them.

Best regards!

Rightly, said. Weldone @crypto.piotr

Thanks for this post @crypto.piotr, at least I have rest of mind now

Thank you very much for the information dear friend, I am about to read the publication and socialize it, have an excellent start of the week.

Hi @crypto.piotr, thanks for this information. Yes, it is a question I also asked myself, if to vote from my blog, comment, make resteem I only need my PostingKey, then why I must enter my active key...It is a valid question. I will check @xpilar's post, to see the justification. Although if I tell you the truth, I do not have any kind of distrust with xpilar, because, so far what he has done has been giving and supporting everyone, for a long time.
Resteem this post.

@tipu curate 5

glad to be part of this. already resteemed to reach a much wider audience

Hi sir I am new here .Pls support me .I am excepting support from you.

@tipu curate 5

Thanks for clarifying this for people that have reservations about it. Nice one buddy

You got a 48.58% upvote from @bidvote courtesy of @crypto.piotr!
<br>

Thanks for notification @crypto.piotr

Thank you for clarifying the doubts

It's a question that I asked myself too, but just like you, I chose to put my trust in Xpilar   

Thanks for the information. I'll definitely check Xpilar's post

I also chose to trust and put my password active, I don't think there is any problem

Hello friend @crypto.piotr.

Actually these concerns are valid, and therefore, the importance of your publication and that of @Xpilar, thanks for providing this type of information to all of us because in this way we will be calmer. Greetings.

Greetings my dear @crypto.piotr, without a doubt it is a hard work that you are doing, which will bring benefits to all of us. It is necessary to keep the community informed which demonstrates the transparency of the process. Thank you for such valuable information.

I was surprised as well when it was asking active  private key. I have checked there after discussion with you about their curation trial. Now form both the posts from your and xpillar, its clear to me. thanks.

thanks for talking about this nice topic that is a question by many over here.  Post esteemed. Thanks again

Hello @cryto.piotr
Thanks for the information, I will review the publication of @xpilar. Reesteemear this post
Regards.

Thanks for the update.

This is so amazing.

Thank you for sharing. I will read @Xpilar post as well.

<hr>
p.s. edit : as i was getting ready it struck me there, you're talking about an autovoting service so maybe ... *its probably unlikely they can get it via keychain since that grants one-time authority afaik so they would need you to re-affirm for every vote and thats why they need the keys themselves* so neither keychain or steemlogin would help much there * <b>unless</b> * its possible to grant authority thats permanent until revoked, like proxy for witness if i remember correctly (its been a long time since i was actually programming on it) . It could be done i guess if the core code got adapted, and maybe it has been done, i really dont know that, i dont live in the middle of the pond with the big fish but i had the impression that, since the takeover, even if it all feels a lot safer and less hostile now, the absolute focus has been developing *steemIT* not *steem* and the chain-tek behind it. SO maybe its possible to grant one account permanent authority to vote for another without them actually ever receiving the key on their side (as would happen with a one-time keychain or steemlogin authorization) ... to that i dont have the answer lol and i never used any of those things since i got right on it when i found condenser and wrote my own scripts for my own voters , and all of them still seem to work despite showing errors on screen, which , i fear is because nothing gets updated there, least of all the docs ...

pardon the lengthy ps but i had to correct it since it wasnt entirely right, but same thing applies : they cant steal your account with the active key and if someone starts a powerdown you should be able to see that unless you never pay attention to your transactions, i guess thats why they made it that way. You probably remember it was seven weeks in the beginning, not four ... (whew) okay ... have a nice day there :))
(end edit)
<hr>
well my good man @crypto.piotr ... after 3 or 4 years you'd think they would explain that to newbies : 

your posting key can't handle transactions from the wallet, which probably means you need the active key for voting, if you use the cli (which for some reason doesnt seem to be developed anymore) it will ask that too, @tipu has those too but actually they COULD use keychain instead of asking to keep them on their servers, thats one of the reasons why i never logged into steem monsters now

the thing is :

even if they got your active key they cant steal your account, they need the master key for that, once they have that they can change the psw and literally lock you out of posting and transacting anything from json to sending steem and sbd

so if they have the active key what they COULD do (i suppose if things havent changed) is send all your liquid steem away in less than a second and these transactions are irreversible , keeping liquid steem in an account where someone else has the wallet key seems like a bad idea anyway unless its just the minor bits from posting

so if you keep an eye open you can see if they start a power down or if they engaged a withdraw from savings , this takes 3 days or a week (times four for full) so you can monitor that, and if that happens once their business will be ousted

which essentially makes it easy to slander anyone who asks for keys at all lol

but it should be safe for anything but liquid steem present

(i dont follow up anymore though and the documentation as well as development on steem-py / cli is cobwebs at best , no idea why since thats the actual strongpoint of steem)

anyway ....

you could push for them to use the keychain plugin if you get enough ppl asking for it, tipu does that too i think

but thats "made by yabapmatt so maybe not everyone trust that lol"

and so and so ... take care

Actually many users have these queries.  Resteemed

Thanks for bringing this up @crypto.piotr :)

That was my concern too resteemed to spread the word