About your requirement “I am interested in verifying that the user is using my application for Windows 8, and not just a hacker using Fiddler.”, I’m not sure how deep you try to protect your application, as if others would like to try use your application in different ways, they will find their way, and if you think that using ACS or LiveSDK add any security, I don’t think so.
ACS or LiveSDK are ways to authenticate a specific user and then let them use your application. When an authentication token is provided to your application about a specific user, and you have no way to save and verify this information again, there is no difference between ACS / LiveSDK authentication in your application or its absence. These oAuth-based services are just a way of authenticating the user, but you will need to write an extra layer of code to provide the user service.
It does not matter if you use ACS / oAuth / or your own membership service, the user will need to enter a username and password in order to be checked from time to time. Based on the time and type of login, you can keep the user active for x time in real time, but the session will expire and the user will need to enter a username and password. Storing a username and password locally to avoid re-entering credentials is not a good application design.
Now about your first question, you should use LiveSDK (not Azure ACS) to authenticate Live users (Hotmail, Live, Skydrive and Outlook), since most services use these IDs in Windows 8, so using one of these will help your application become part of one and the same ecosystem. You can use this last document to use the Live SDK in your application. If you use the Live SDK in your Windows 8 application, and the user uses the same Live ID for his other application in Windows 8 and logs in before your application, your application will already have a live session, to use it depends from Live ID and application settings,
About your second question, "Encrypt and store user login information so that the user cannot enter login information each time?" I don’t know why you need it. First of all, no oAuth service will give you user credentials, except for a username that you can save to check if the user is visiting again and that you can use it to make sure that he is the right user. You need to store this information in the cloud, and then after authentication do whatever you want.