i set up a vault with my GPG stuff and encrypted a message to a friend.
GPG is leaking my timezone and the time the message was encrypted.
This time noted in the message is correct, but in the vault date is off by a few hours (because the vault thinks i am in a different time zone) and hwclock --show --verbose revealed, that there is no access to the hwclock.
How can GPG within the vault know what time it is/in what timezone i am?
Could someone please explain how this could be possible?
qubes get the time from dom0 at start up, and the clocksync service
keeps them in step.
If you are concerned about privacy, then either work in UTC or use a
random timezone, and keep your work patterns consistent with that time.
I figured, that i might have chosen my normal timezone in the installation and set only the clock in the taskbar to show the time in UTC. But, that is not an issue in this case, as i found out.
There was another fact i was not aware of: GPG does not include the timezone information. I think it is added in the output of GPG when verifying the signature and as my friend is in the same timezone as me this would explain this behavior.
I was just a bit freaked out thinking, that my crypto vault is behaving not like i expected it and that should never be the case.