it works a bit different. if you click "login with steam", you log in with the original steam api, linked to the steam site.
if you do that, steam shares a unique code with that site, so they can see your public profile and stuff. but steam doesnt give away your acc data. (thats how it normally works)
its similar to "log in with your facebook togive a like". you actually log in with facebook api but it will be connected to that side, if you accept.

edit: if you want to be safe, login on original steam website first. then you will be already logged in. and if you click at any "log in via steam" buttons, then they should redirect you to steam webseite and because youre already logged in, steam will only ask, if you want to connect to that website.
that way you can prevent to be directed to a possible fake steam site where you need to enter acc data.

actually, in any site where you're required to login with your Steam account, just make sure that you're actually on the real steam page (just check the URL), as long as you're using the real steam, then there's no way anyone can ever do anything with and/or to your account, for the simple reason that Steam's API doesn't provide any means to

(and for the password stealing specifically, just like any other API for third-party services, it all goes through the API provider -in this case Steam- and those using it -in this case MarvelousGA- just get a validation token -that usually has a really short lifespan- and a message saying that everything's ok...your Steam, Facebook, Google+, whatever password never goes through any of the sites using their services/APIs, just make sure that you actually ARE login-in through the real site and not just an impersonator)

edit 1: there are sooooooooooo many myths around whenever a site asks you to log in through a different service...

edit 2: I wouldn't know, still, specifically WHY ON EARTH MarvelousGA asks you to log in with your Steam account since it doesn't offer any functionality at all steam-account-related

edit 3: I wasn't defending it, I still think that MarvelousGA is a very shitty and poorly developed site (and do have my thoughts on whether any of it is actually real), except for the really shitty keys, they're giving those away for real, that I can tell XD

i tihnk there is some misunderstanding. steam is providing and/or selling drm-free games too.
the difference is: even drm free games use steam client to be launched. but if the game really is drm free, you can move the game data from steamapps to other location and search for the original game exe. and if its drm free, the game mostly opens with the original game exe without opening steam launcher.

the reason, why drm free games use steam client first, is, after istalling steam makes a shortcut to desktop and its linked to steam client that opens the original game exe.

so that means... maybe some games really are drm free but we think they are not, because steam always links shortcuts to the steam launcher first. i think there was a websitre where you could check all drmf ree games on steam.. just google, it should help.

Thank you for your response and your time.

I worked with the OpenID folks back when it was still a thing. I know what you're getting at and I recognize it.

I work with a webhosting company that caters to soccer moms. We see stuff like this quite often (edit: Our support forum is an open forum and we encourage our clients to raise nearly any topic that want to.) and it's setting off bells and whistles. I'm not going to go into details since it would be a security matter for our clients but I will mention not seeing any information on the page is the first thing setting off bells and whistles for me. There's other things as well.

i think i didnt understand you well. so you say, its probably better not to use offers like "login via steam" on unknown sites, even if you login in steam first?

I would think there would be some issues with passing the login cookie. I;ve got yet another kid screaming "mom mom mom mom mom mom" here at the library. Kind of hard to think today and work things out.

mhm ya well, if you ask me, im not really sure if its safe, either. but the method how steam works and shares profiles with other pages, it sounds safe. but how safe, i cant tell you that.

but on the other hand, big websites like gog, humble and indiegala also want your steam profil data and you need to connect with them.

they added the drm-free version. at least to me.

has anyone paid any attention to anything I said about this?

each case is different, of course, but Steam specifically I'd say it's completely harmless unless you don't want others to access your (should be already) public profile, but through internal credentials instead of just giving (whomever) just a link to a profile that could be actually anyone's

with stuff like Facebook it's pretty different, there someone can do LOTS of stuff, but then again, you do actually go through a screen that tells you exactly what permissions you're giving, to which public should they post, etc etc etc

so it's really up to you, more than the site you're login into through whichever account

that, again, assuming you take the work of looking at the URLs and checking that you're login into whatever you're supposed to, because it's just copy pasta to get something that looks and behaves identical to, for instance, Facebook or Steam...but you can't mess around with domains (basically)

I've got it added for me as well. I've updated my post to reflect the change.

It's actually great, I've seen the discussion below, but I wont continue because everything I could add to it has been said. I have got lots (and lots (and lots)) of keys from there. The only technical problem I can think off is the fact that you only need to do half of the tasks to get a key (and after about a week you should learn what ones they are :-) ) so yeah, good site!

to tell you the truth, I have no problem with it other than finding it incredibly tedious to use, 3 things mainly:

- the login redirection: whenever you're not logged in (and it auto logs out quite often), you're redirected to a different page, no way to go back, then you login again, and end up in the dash board...the problem here is that so often I don't really keep track of what I'm doing there, and my browser is opened with a thousand tabs forever, so whenever this happens I don't really see it happening until much later, the moment I realize I have 3 opened tabs with MarvelousGA dashboards

- the zero notifications: as far as I can tell, they have no means of notifications whatsoever, this translates as "if you want to know if you won anything, you have to check it yourself, on the corresponding giveaway", this is very related to the first point and the reason why I would keep 3 or whatever MGA tabs open, just to check those giveaways, after a few days, I can't even recall what I was doing, and said login-redirection doesn't help at all

- the extremely poor verification process: each giveaways has a number of required tasks to enter, each task needs to be verified, and each verification redirects you to the same URL/page with a slight variation in the URL, those end up summing up into incredibly long URLs (and I haven't checked it myself, but those have a limit, given enough tasks and an even longer URL, the system should fail), the point here is that you require all those validations to "get the key", even if you already have done all of them, in my experience, it doesn't check it in real time when you hit the "get the key" button, more like it checks that everything is checked that very same instant...

----

if you put those 3 things together, you see the problem, it's quite easy not know what were you doing there, it's quite easy to lose "the job you took" to do all those tasks, when this redirection, re-login and stuff, keeps you having to reload the page from scratch and then starting with all the tasks from scratch...

I've come to a method where I make sure to never close the browser, so those tabs won't reload, and when I want to check anything, I first open a new tab on MarvelousGA, that gets me through the login, then go back to the other tab where I have the giveaway and only then reload that one page...just to check something...and even so...

So, I ended up not using it anymore...it's like "free games!...mmneh...I don't have that much free time to neither do this all this nor play that much games" XD

There even is a big thread here on GOG (which is the reason why the list you mentioned is even there).
https://www.gog.com/forum/general/steam_games_you_can_play_without_the_steam_client
http://steam.wikia.com/wiki/List_of_DRM-free_games

did you contact humble and ask them to add the drm free version? because back then i only got the steam key.

I didn't contact them at all. After LiefLayer mentioned that he had the DRM-free download added to his purchase page, I decided to check on mine again and saw that it got added. I assumed humble had added it to everyone's purchase page but I could be wrong. I suggest that anyone that got the Psychonauts freebie to go recheck their purchase page to see if they got the DRM-free download added.