I'm in the process of encrypting the user data on my app and have adopted the scheme in this answer to secure user emails, passwords, name and other private details. I'm using an AES surrogate key and a locking key generated from the password.
So far, so good.
However, I've realized that when I come to the user's status (like a Facebook feed), it's not so straight forward.
Of course, I can encrypt and recover the user's status with the scheme above. But how do I get the status of their friends to show on the user's feed? According to the scheme above, I would need to have the friend's password in order to decrypt this. By design, I never see the friend's password, and the user only knows their own password.
The only way I can find is something like this answer that uses a document key and user key implementation.
Do I really have to go to the lengths of implementing OpenPGP?
When a user adds friends, do I then have to somehow add their key to all of the previously encrypted documents? Doesn't seem feasible. How do the social media companies do it?