It's very smart of you to not give away your keys easily, @showtime24. The Private Posting Key is used for posting posts, comments, and voting. So worst case scenario someone could do things like:

• Drain your voting power by upvoting their own accounts.
• Post spam, phishing links etc. as blog posts.
• Use your account to post spam comments.

No one would be able to steal any money with only this key, so at least that's not a concern, but as you can see, it can still do a lot of damage.

I also fully agree that it would be best for them to implement Steemconnect as a method for logging in. They have already used that for paying for card packs, so I don't see any reason not to use it for login as well.