Sort:  

Well without getting into general client-side precautions a user might do, and in addition to the points I've already made, I have another idea for what Steemit could do. That is make all interactions with the "owner" or master private key password take place on a different domain so Content Security Policy and the browser sandbox can protect those interactions against cracks due to user-generated content which @dan mentions as an additional current vulnerability of Steemit compared to Blockchain.info.

Edit: this was previously suggested as a "standalone app".