I am writing an open-source Java application for Google App Engine (GAE). The application will let users create content that is intended to be private. I want to provide reasonable assurances that no one (including me, as the site administrator) will be able to read private content that belongs to someone else. What is the best way to accomplish this?
The site will be served using https. Users will log into my application using OpenId, so I am not in control of their login credentials (I don't have their password).
Based on the research I have done so far, I think one solution might be to encrypt data written to the GAE datastore using a password-based encryption key. The user would choose a separate password to be used only for encrypting their private data. To generate the encryption key, I would hash the password somehow (maybe bcrypt?). Data written to the GAE datastore would then be encrypted using the encryption key plus a salt, and the salt would be stored alongside the encrypted blob. I would never permanently store the password or the encryption key, but I'd probably need to keep the encryption key on the session while the user is logged in.
Is this a good solution? Are there other solutions I should consider instead?
I would also appreciate any pointers to existing open source applications that do this kind of thing properly.
Edit (20 Dec 2011):
I'll try to clarify what I'm looking for.
Google App Engine supports two roles: users and administrators. In this case, a user is anyone who chooses to log into the site via OpenId. An administrator is a special type of user which also gets access to the application's administrative console. Among other things, administrators can view logs and directly manipulate the back-end datastore (read and write). Some administrators -- let's call them administrator/developers -- also have the ability to deploy new code.
Users can be expected to create both public and private content. I want users to feel confident that content they mark as "private" really can't be viewed by anyone else.
I recognize that a malicious administrator/developer could upload code with a back door to circumvent the privacy design. However, that problem will have to be solved via auditing. Because the code is open-source, users who are concerned about the software implementation have the opportunity to review the code and convince themselves of its integrity.
I also recognize that a large part of getting this right is simply good application design. For instance, the back-end should require authentication and should not let authenticated users view data that they don't own. There should also be test coverage sufficient to confirm that this functionality works as intended. This part of the application design is already in place.
When I asked this question, I was hoping to find a solution that offered a higher level of assurance. I am looking for a design that protects -- as much as is practical -- against malicious users, malicious administrators, and unintentional software bugs in systems that I control. If at the same time this solution also offers some protection against malicious or incompentent system providers (i.e. Google personnel looking at things they shouldn't, or App Engine bugs that inadvertently disclose my data), then that's even better.
I realize that I can't protect against every attack vector in an application like this, and certain solutions are going to be too ugly -- or too annoying from a user perspective -- to be practical. There may be no solution which is "better" than what I already have implemented. In that case, I'd like to document the reasoning behind that conclusion. However, if there is a reasonable solution, I would like to find it.