I'm putting together an ether/erc20 token wallet in a chrome extension but would like to follow best practices with regards to private key security.
I'm using localstorage to handle login and its contents are as follows
Localstorage (no account):
(empty)
Localstorage (signed out):
password hash
encrypted private key
Localstorage( signed in):
password hash
decrypted private key
expiry timestamp for decrypted private key
is there anything intrinsically dangerous about this? I'm using npm packages web3v1 (beta) and crypto-js