I'm developing an application that automates processes. The user connects to many accounts that the application uses then passwords are encrypted using AES. An example algorithm looks like this:
- When user add an account, password hash will generate
AES(password, SHA1(accountLogin) + SHA1(accountPassword) + SHA1(pin))
- Then this encrypted string is stored in the local database
- To decrypt this string, the user needs to be logged into the app, and user need to pass pin code which is not stored anywhere
Is it secure to store this password's encrypted string in the remote database so users can use the app on different devices? This is so that they don't need to provide the passwords for the accounts in the application.