Google is bringing in new network security features as part of Android 17, with support for Encrypted Client Hello (ECH), a privacy standard that prevents network operators from seeing the domains a user visits.
ECH works in conjunction with private DNS to obscure profiling data, such as the names of the websites visited, by encrypting the part of the TLS handshake that reveals the hostname of the site contacted.
In Android 17, this protection is built into the platform and is turned on by default for applications targeting Android 17 that use a networking library that is compatible.
The update also includes Local Network Protection, Certificate Transparency by default, and automatic blocking of 2G.
Android 17 Adds Encrypted Client Hello and ECH GREASE #
ECH serves as a privacy feature for TLS, the protocol used to secure HTTPS connections. It encrypts the initial stage of the TLS handshake in which the hostname of the destination site is disclosed through the Server Name Indication (SNI).
Although a connection to a website is secure, internet service providers and Wi-Fi operators are usually still able to see the destination, which can then be gathered for commercial profiling.
As Google explained, this new privacy standard works together with private DNS to conceal the names of the websites you visit, thereby hiding the metadata that could be used to profile you; by encrypting the name of the destination website right from the start, ECH helps make it so that, for supported websites and apps, network providers and any persons eavesdropping on the network can no longer easily see which websites or apps you are accessing.
Android users have already been able to take advantage of ECH when using Chrome from version 117 onwards or Firefox from version 119 onwards, but with Android 17, the protection is extended to the platform level.
For apps that are aimed at Android 17 and make use of a compatible networking library, such as the most recent versions of OkHttp, WebView, or HttpEngine, ECH is enabled by default. When the servers support ECH, Android encrypts the hostname, but when they do not support it, Android sends a fake field called ECH GREASE that looks like ECH, so that actual ECH connections don't stand out, even though the hostname is still visible in that situation.
The team at Jigsaw, which is Google's unit responsible for internet privacy and anti-censorship, tested ECH GREASE on the top 10,000 domains through 740 internet providers in 202 countries and found that there were no problems with sites or any unexpected network blocks.
Android 17 Adds Local Network Protection, Certificate Transparency, and 2G Blocking #
In addition to ECH, Google also announced a number of other network protections, one of which is that Local Network Protection now requires applications to get permission before carrying out a scan for or connecting to devices on the user's local network.
Android 17 makes it necessary for website certificates to be entered into public logs, thereby enabling Certificate Transparency.
Google has also announced that mobile operators taking part in the program can now automatically switch off 2G for their subscribers, thereby reducing their exposure to SMS blasters and to rogue base stations which are capable of delivering malicious messages or capturing sensitive traffic from nearby devices.
The protections are introduced with Android 17. For applications targeting Android 17 that make use of a compatible networking library, ECH is enabled by default, meaning that the advantages of the feature rely on both the app and the destination server supporting it.
The automatic switch-off of 2G depends on the mobile operators involved in the scheme enabling it for their subscribers, and Google has not specified which operators are participating. Even on servers that do not support ECH, users will still have their hostname visible because of the ECH GREASE field.