In our new Crypto 101 post we explain the xpub, the extended public key. It can't spend a single coin, but it can show every address in that account, so handing it to an app or a service hands over your balance and your whole transaction history. Our advice: treat it like private information.