Just almost slipped up: a "looks pretty similar" airdrop page popup asked me to sign an authorization first, basically letting it freely manipulate your assets later. My bottom line now is simple: never input your seed phrase on a webpage; if you don't understand the signature request, don't sign it, especially those with unlimited limits and long-term validity—better to miss out. Recently, everyone’s arguing about whether NFT royalties should be mandatory, but I think no matter how intense the competition gets in the secondary market, at least don’t push users’ sense of security to zero... Anyway, I’ll just clear out old authorizations first, to sleep peacefully tonight.