I'm working on an app that stores sensitive data (think of it as a password locker) for the UWP (Universal Windows Platform).
The most important requirement is the ability to roam the data between user's devices, so that the user can add his password on desktop and have it automatically synced on mobile.
Of course this opens to potential issues, as the data must be encrypted before storing and syncing it.
To make things harder, I'd also like to give the user to login into the app by using a short PIN or Windows Hello (biometric or PIN).
The whole scenario requires a lot of attention on different things:
- To avoid asking for password everytime the user adds/deletes data, I need to keep it somehow in memory for the whole session, so that I can encrypt and save the data everytime a change happens. Keeping it in memory doesn't seem the best choice to me, as memory can be read by potential attackers, but I can't think of anything better.
- If the user chooses to use a PIN as password replacement, we still need to know the password to be able to encrypt/decrypt data, so I thought that I may use this PIN to encrypt the master password and sync the encrypted password alongside the encrypted data (and maybe the hashed PIN, so that the same PIN can be used on another device). Is this a good idea?
- If the user chooses to use Windows Hello, things are a little bit harder: Hello generates a key that depends on both app and current device, so the same app will have different keys on different devices, and this defeats the purpose of using Hello in my case, as I won't be able to encrypt the master password with Hello key and use it on another device. My idea, for now, is to use user's data (for example the email or an account id) to encrypt the master password, and use Hello only as a gateway to the app, but this will require my app to ask for permissions on each device, meaning that the user will need to run the initial setup on each device (and I'd like to avoid that). This also means that the email or the account id should be synced with the rest of app data, potentially giving away both the encrypted password and its key. What would you do in this case?
I'm well aware of the existence of a PasswordVault that I could use to store the master password, so that I can just use PIN or Hello to access the Vault, but my previous experience was awful, as user's data syncing was faster than Password Valut's one, leaving the app in an inconsistent state (e.g. having user data on the new device but no key to decrypt them).
I understand that the question may be too broad and that I can maybe lower my requests, but I'd like to do things in the best possile way.