Managing security of a desktop/mobile app

Question

I'm working on an app that stores sensitive data (think of it as a password locker) for the UWP (Universal Windows Platform).

The most important requirement is the ability to roam the data between user's devices, so that the user can add his password on desktop and have it automatically synced on mobile.

Of course this opens to potential issues, as the data must be encrypted before storing and syncing it.

To make things harder, I'd also like to give the user to login into the app by using a short PIN or Windows Hello (biometric or PIN).

The whole scenario requires a lot of attention on different things:

1. To avoid asking for password everytime the user adds/deletes data, I need to keep it somehow in memory for the whole session, so that I can encrypt and save the data everytime a change happens. Keeping it in memory doesn't seem the best choice to me, as memory can be read by potential attackers, but I can't think of anything better.
2. If the user chooses to use a PIN as password replacement, we still need to know the password to be able to encrypt/decrypt data, so I thought that I may use this PIN to encrypt the master password and sync the encrypted password alongside the encrypted data (and maybe the hashed PIN, so that the same PIN can be used on another device). Is this a good idea?
3. If the user chooses to use Windows Hello, things are a little bit harder: Hello generates a key that depends on both app and current device, so the same app will have different keys on different devices, and this defeats the purpose of using Hello in my case, as I won't be able to encrypt the master password with Hello key and use it on another device. My idea, for now, is to use user's data (for example the email or an account id) to encrypt the master password, and use Hello only as a gateway to the app, but this will require my app to ask for permissions on each device, meaning that the user will need to run the initial setup on each device (and I'd like to avoid that). This also means that the email or the account id should be synced with the rest of app data, potentially giving away both the encrypted password and its key. What would you do in this case?

I'm well aware of the existence of a PasswordVault that I could use to store the master password, so that I can just use PIN or Hello to access the Vault, but my previous experience was awful, as user's data syncing was faster than Password Valut's one, leaving the app in an inconsistent state (e.g. having user data on the new device but no key to decrypt them).

I understand that the question may be too broad and that I can maybe lower my requests, but I'd like to do things in the best possile way.

Answer 1

Not really sure why you think this is that hard?

I'm afraid I'm not sure why you want to create a new password store app either when many already exist? If you feel the need for another app with some new features, please consider using an existing secure back-end such as the excellent KeePass. This has already solved the secure storage issue.

Then all you need to do is to make use of the Windows Passport libraries to use Windows for SSO though I'd have to say that personally, I wouldn't use such an app as most people configure their mobile login for convenience as much as for security and I wouldn't consider that secure enough for my password management tool.