Seems like they use SteemConnect.com to authenticate their users. I've recently created a [discussion board integrated with steem](https://steemit.com/steemdev/@aley/steemstack-net-a-discussion-board-build-on-top-of-the-steem-blockchain) and do also use SteemConnect. So basically you don't need to give away your keys and you can revoke access to certain apps. Still SteemConnect is a foreign provider with access to your keys, but as they are operated by Steemit and Busy, they have good reputation.