Posting key is fine to use to log into 3rd party sites.  Otherwise we could only use steemit.com and that wasn't the intent for the blockchain because that would make it centralised in a sense.

For example, steemit inc prevents minnows from flagging at 100%. All of their upvotes are at 100%, but when flagging on steemit.com (and I think busy.org implemented this too) you cannot flag at 100%. So actually third party sites could be better. Just don't give any key other than posting key, and when giving out posting key, always check the t&c to make sure you're not giving permission to post or vote with your account.