> To put it in another way let's say there was a website that said it authorized with Steam. It asked you to put in your steam username and password. Is this se

> To put it in another way let's say there was a website that said it authorized with Steam. It asked you to put in your steam username and password. Is this secure? "Is this secure?" fully depends on what the attack vectors you're considering are. Breach of the server's database? Make it an app instead of a website and make requests directly. Malicious code in the client itself? Make it open source. Now it's even more secure than the official client. But regardless of all of this, how is it any of the service provider' s business what I do with my login details? It's my data on my account. If I use it in an insecure fashion, that's my problem. I am free to post my login details on Twitter for everyone to see, so why can't I put them in a database on some russian dude's basement server?