Is it possible to securely use a remote service in a completely hostile network environment
A worldbuilding technical question!
I am an extremely evil power-mongering country government. There is a company S under my jurisdiction, physically located completely inside the borders. This company provides services worldwide, including a customer in a country Y, which I am in a hostile relationships with. I have zero control over anything happening or located inside country Y's borders.
Now, let's assume that the company S is using all the current security standards and have the user data privacy built-in directly into their product. They store user data on their disks exclusively as encrypted blobs, which come to them already encrypted, and all the network exchange with clients is being made over latest TLS. User authentication/authorization is being made using client-side certificates. Absolutely zero PII is being kept unencrypted, if the customer loses their half of a keypair, their data is lost forever.
Assume year 2023.
Assume that I am able to spoof anything in the Internet outside of country Y's borders. I have physical access to routers, I have control over root DNS servers, I can MITM into any network segment, I have control over the data storages hosting source code for the software. But only outside of country Y's borders!
Assume that I am able to force to submit absolutely any business and government entity outside of country Y, including the company S. Hosting services, judical systems, ISP's, standardization commitees, doesn't matter, anybody. Again, only outside of country Y's borders.
Now, the question.
Is there any technical way for that client in the country Y to ensure:
- that their data stays undisclosed;
- that their data is untampered with;
- that their communication with company S's services will not be read;
- that their communication with company S's services will not be tampered with?
