It only requires your active key one time to give @leofinance posting authority on your account. To avoid typing my active key on my mobile I log into Peakd via my desktop and give posting authority to that account there. That way I can just log in on mobile moving forward with just the posting key. It keeps my only threat to my active key within Hive Keychain instead of introducing another attack vector.