I am creating my own wallet as hobby project. I want to avoid using metamask, so idea is to store private key encrypted(AES) on my server, where salt will be my password.
When I enter password and log in to my account, server will send encrypted key back to me which will be stored into local storage or cache. To do transaction I will then have to put password each time, which will decrypt private key from local storage, sign transaction and send signature to network via web3.js.
Now I know cold wallet and metamask is way more secure, but I want to avoid both, to make users life easier, but for me this is research project.
I am interested from security perspective in what cases would this be vulnerable? In case server is breached and someone gets password it can decrypt private key. Ok, this is breach server + somehow get your password. Another options?