So my question is about the to which degree Web3Auth is trusted? I played around with their SDK a bit, and after user logs into the DApp, the application can even retrieve user's private key and initiate any kind of transaction without even prompting anything to user.
You might say the user shouldn't have logged in to shady DApps in the first place, but still compared to browser wallets such as Metamask, which at least requires the validation of the wallet owner for sending transactions etc. even when it is connected to the website, it seems relatively unsecure.
I would like to hear any supportive or refutive ideas if any, or if I'm missing anything.