Android 17 Adds OS-Wide ECH to Hide Website Visits From Network Providers
Android 17 adds OS-wide Encrypted Client Hello (ECH) to hide website visits from network providers.
Google's Android 17 update introduces Encrypted Client Hello (ECH) as an operating system-wide feature to prevent network providers from seeing which websites users visit. This privacy standard works with private DNS to obscure domain names, enhancing user privacy. The update also includes Local Network Protection, mandatory Certificate Transparency, and the ability for telecom operators to disable 2G by default to mitigate risks from SMS blasters and rogue base stations.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAndroid 17's introduction of Encrypted Client Hello (ECH) addresses a longstanding privacy gap where network providers and ISPs could observe users' browsing destinations through unencrypted TLS handshakes, even when HTTPS was in use. Without ECH, the Server Name Indication (SNI) field in TLS connections exposed domain names in plaintext, enabling traffic analysis, surveillance, or censorship by network intermediaries. This OS-level integration matters because it removes the burden from individual users to configure privacy tools, making strong transport-layer privacy the default. The accompanying features — Local Network Protection, mandatory Certificate Transparency, and 2G disablement — collectively reduce attack surfaces from rogue infrastructure and fraudulent certificates. The lesson is clear: default-secure configurations at the platform level dramatically improve privacy outcomes across entire user populations.
What helps against this
How we list vendors
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.