Android 17 adds ECH support to make web browsing harder to track
Android 17 adds Encrypted Client Hello (ECH) to enhance web browsing privacy by encrypting visited domain names.
Run Chrome?
Get an email when a reviewed story names Chrome, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Android 17 is introducing Encrypted Client Hello (ECH) as a platform-level privacy feature to encrypt visited domain names, making web browsing harder to track by ISPs and Wi-Fi operators. This feature works with private DNS and will be enabled by default for apps targeting Android 17 using compatible networking libraries. Additionally, Android 17 enhances local network protection and enables Certificate Transparency by default, while participating mobile operators can now disable 2G to reduce exposure to SMS blasters and rogue base stations.
The lesson from this incident
Full lessonA longstanding privacy gap in mobile browsing has been that even when HTTPS encrypts page content, the domain name a user is visiting remains visible in plaintext during the TLS handshake — exposing it to ISPs, Wi-Fi operators, and potential eavesdroppers. Android 17 addresses this with Encrypted Client Hello (ECH), which encrypts the Server Name Indication (SNI) field, closing this metadata leakage channel at the platform level. The addition of Certificate Transparency enforcement and local network access protections further reduces the attack surface for rogue actors and man-in-the-middle scenarios. This matters because passive traffic analysis and SNI-based surveillance are widely used by both commercial trackers and malicious actors on untrusted networks, making these defaults a significant privacy uplift for end users.
