Actually I might be misunderstanding the process. Reading the messages carefully, it seems that steemconnect needs my active key in order to grant my posting role to busy.org.
This is complicated. I would prefer simply to login using my posting key. That way I would know what I am doing. Or rather, I would feel like knowing what I do.
It is not a good thing if we get used to having "man in the middle" sites for the login. Just as you wrote: a login that seems quite usual and - bamm - the hacker got you.