{"slug": "android-17-adds-encrypted-client-hello-local-network-protection-and-automatic-2g", "title": "Android 17 Adds Encrypted Client Hello, Local Network Protection, and Automatic 2G Blocking", "summary": "Google's Android 17 introduces Encrypted Client Hello (ECH) by default for compatible apps, preventing network operators from seeing visited domains, alongside Local Network Protection, Certificate Transparency, and automatic 2G blocking. The update, announced by Google, extends ECH to the platform level, with Jigsaw testing ECH GREASE across 740 providers in 202 countries without issues.", "body_md": "# Android 17 Adds Encrypted Client Hello, Local Network Protection, and Automatic 2G Blocking\n\n[Google](https://www.ghacks.net/2026/08/26/google-reportedly-in-advanced-talks-for-1-5-billion-deal-with-ai-coding-startup-mechanize/) is bringing in new network security features as part of [Android 17](https://www.ghacks.net/2026/06/17/android-17-and-wear-os-7-roll-out-with-bubbles-multitasking-granular-privacy-controls-and-live-updates-on-watches/), with support for Encrypted Client Hello (ECH), a privacy standard that prevents network operators from seeing the domains a user visits.\n\nECH works in conjunction with private DNS to obscure profiling data, such as the names of the websites visited, by encrypting the part of the TLS handshake that reveals the hostname of the site contacted.\n\nIn Android 17, this protection is built into the platform and is turned on by default for applications targeting Android 17 that use a networking library that is compatible.\n\nThe update also includes Local Network Protection, Certificate Transparency by default, and automatic blocking of 2G.\n\n## Android 17 Adds Encrypted Client Hello and ECH GREASE\n\nECH serves as a privacy feature for TLS, the protocol used to secure HTTPS connections. It encrypts the initial stage of the TLS handshake in which the hostname of the destination site is disclosed through the Server Name Indication (SNI).\n\nAlthough a connection to a website is secure, internet service providers and Wi-Fi operators are usually still able to see the destination, which can then be gathered for commercial profiling.\n\nAs Google explained, this new privacy standard works together with private DNS to conceal the names of the websites you visit, thereby hiding the metadata that could be used to profile you; by encrypting the name of the destination website right from the start, ECH helps make it so that, for supported websites and apps, network providers and any persons eavesdropping on the network can no longer easily see which websites or apps you are accessing.\n\nAndroid users have already been able to take advantage of ECH when using Chrome from version 117 onwards or Firefox from version 119 onwards, but with Android 17, the protection is extended to the platform level.\n\nFor apps that are aimed at Android 17 and make use of a compatible networking library, such as the most recent versions of OkHttp, WebView, or HttpEngine, ECH is enabled by default.\n\nWhen the servers support ECH, Android encrypts the hostname, but when they do not support it, Android sends a fake field called ECH GREASE that looks like ECH, so that actual ECH connections don't stand out, even though the hostname is still visible in that situation.\n\nThe team at Jigsaw, which is Google's unit responsible for internet privacy and anti-censorship, tested ECH GREASE on the top 10,000 domains through 740 internet providers in 202 countries and found that there were no problems with sites loading or any unexpected network blocks.\n\n## Android 17 Adds Local Network Protection, Certificate Transparency, and 2G Blocking\n\nIn addition to ECH, Google also announced a number of other network protections, one of which is that Local Network Protection now requires applications to get permission before carrying out a scan for or connecting to devices on the user's local network.\n\nAndroid 17 makes it necessary for website certificates to be entered into public logs, thereby enabling Certificate Transparency.\n\nGoogle has also announced that mobile operators taking part in the program can now automatically switch off 2G for their subscribers, thereby reducing their exposure to SMS blasters and to rogue base stations which are capable of delivering malicious messages or capturing sensitive traffic from nearby devices.\n\nThe protections are introduced with Android 17. For applications targeting Android 17 that make use of a compatible networking library, ECH is enabled by default, meaning that the advantages of the feature rely on both the app and the destination server supporting it.\n\nThe automatic switch-off of 2G depends on the mobile operators involved in the scheme enabling it for their subscribers, and Google has not specified which operators are participating. Even on servers that do not support ECH, users will still have their hostname visible because of the ECH GREASE field.", "url": "https://wpnews.pro/news/android-17-adds-encrypted-client-hello-local-network-protection-and-automatic-2g", "canonical_source": "https://www.ghacks.net/2026/08/28/android-17-adds-encrypted-client-hello-local-network-protection-and-automatic-2g-blocking/", "published_at": "2026-08-28 10:56:35+00:00", "updated_at": "2026-08-28 11:18:55.628233+00:00", "lang": "en", "topics": ["ai-policy"], "entities": ["Google", "Android 17", "Jigsaw", "OkHttp", "WebView", "HttpEngine", "Chrome", "Firefox"], "alternates": {"html": "https://wpnews.pro/news/android-17-adds-encrypted-client-hello-local-network-protection-and-automatic-2g", "markdown": "https://wpnews.pro/news/android-17-adds-encrypted-client-hello-local-network-protection-and-automatic-2g.md", "text": "https://wpnews.pro/news/android-17-adds-encrypted-client-hello-local-network-protection-and-automatic-2g.txt", "jsonld": "https://wpnews.pro/news/android-17-adds-encrypted-client-hello-local-network-protection-and-automatic-2g.jsonld"}}