Active key gives possibility to transfer and allows to perform all functionality on eSteem, while posting key only allows social operations. You can login even with master password or steemconnect, no matter what you use, your keys always stored on your device encrypted with pin code you set. So it is most secure key storing, if someone try to guess or brute force, app will simply delete all credentials from your device and attacker won't get anything, but you will have to relogin again.
RE: Huge eSteem iOS 2.2 update now available to Apple users