That's a good question. The hierarchical threshold multisig permission model used by Steem (and BitShares) is much more flexible and powerful than Bitcoin-style multisig (for example @xeroc mentions in a comment here that a member of a multisig authority is free to change their own keys at any time).
The problem is that our current permission types -- posting, active, and owner -- are too coarse-grained for third-party integrations. Finer-grained permissions seem like they might have some value, for example I can think of a few services off the top of my head:
- A vote management service like streemian.com can vote on your behalf, but not post.
- A post management service (which might e.g. mirror blog posts from your Wordpress site to your Steem account) can post on your behalf, but not vote.
- A trading console service (3rd party market UI) can place and cancel market orders on your behalf, but not transfer funds.
- A liquidity management service can manage vesting deposits / withdrawals and requests to move funds to/from savings to maintain certain level of liquid funds in your account, but cannot place market orders or transfer the funds to another account's control.
The management of third-party permissions from the UI perspective could probably be improved.
From a blockchain backend perspective, the blockchain isn't really designed with flexible permissions in mind. The internal blockchain API's, objects and the public protocol fields don't scale to M different possible permission types which may be delegated to N different third-party service providers.
It's going to take some design work to get this right.
The additional granularity of permission delegation would definitely be a way to improve on security. For a user like me though, that still might not be enough. I probably won't be trusting any apps that can do things with my account unless they are actually integrated into the Steemit website.
I don't know how many users are like me, but I am very wary of trusting any delegation of control over actions taken with my account. Even with voting or posting authority, a malicious app developer could do a lot with that access. (Especially if they wrote a good app that attracted a large user base.)
The thing that I am curious to see is whether this is a hurdle that we will overcome, and a decentralized network of stand alone apps is where we will end up; or if we will need to head more in the direction of a centralized Steemit platform with everything baked in.
Downvoting a post can decrease pending rewards and make it less visible. Common reasons:
Submit