Posting Key.
When I joined in June, Steem 1010 advice was dispensed in the joing FAQ, which was adamant that using the "posting key" most of the time was imperative, and that if I used and compromised my master password, it would all be on my own head.
Since then, I have realized there are ways to get your account back even if you lose your master password (ie with help), but this should never be relied on.
Sorry your brother-in-law got burned like that. :(