[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpeKqrE1-9xuXFvBmQ7f-qLeNPBYY8CMt3fUsw2CJ2Nk":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49},"d5009c79-01c4-4a23-b726-e92dc32c2129","android-17-encrypts-dns-lookups-and-hardens-network-privacy-by-default","c4f7816b-eeb7-438f-aba0-1856ad6cc7ce","Android 17 Encrypts DNS Lookups and Hardens Network Privacy by Default","A longstanding privacy gap in mobile browsing has been that even when HTTPS encrypts page content, the domain name a user is visiting remains visible in plaintext during the TLS handshake — exposing it to ISPs, Wi-Fi operators, and potential eavesdroppers. Android 17 addresses this with Encrypted Client Hello (ECH), which encrypts the Server Name Indication (SNI) field, closing this metadata leakage channel at the platform level. The addition of Certificate Transparency enforcement and local network access protections further reduces the attack surface for rogue actors and man-in-the-middle scenarios. This matters because passive traffic analysis and SNI-based surveillance are widely used by both commercial trackers and malicious actors on untrusted networks, making these defaults a significant privacy uplift for end users.","**Immediate actions:**\n- Audit your organization's mobile device fleet to identify which Android versions are in use and plan upgrade timelines to Android 17.\n- Enable private DNS (DNS-over-TLS or DNS-over-HTTPS) on all managed Android devices as an interim measure until ECH is available.\n\n**Configuration & deployment improvements:**\n- Update internal mobile apps to target Android 17 APIs so they automatically inherit ECH and Certificate Transparency protections.\n- Disable 2G connectivity on managed devices via MDM policy to reduce exposure to SMS blasters and IMSI catchers where carrier support allows.\n- Enforce Certificate Transparency validation in any custom networking code or third-party SDKs used within enterprise apps.\n\n**Long-term security architecture:**\n- Adopt a Zero Trust network model that does not rely solely on network-layer controls, assuming traffic metadata may be visible on untrusted segments.\n- Establish a mobile security baseline policy aligned to CIS Benchmarks for Android that is reviewed with each major OS release.\n- Train developers on privacy-by-default principles so new apps leverage platform-level privacy features rather than implementing ad-hoc solutions.",[12,13,14,15,16,17,18,19,20,21,22],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 12: Network Infrastructure Management","CIS Benchmark for Android","NIST SP 800-124 Rev. 2 (Guidelines for Managing Mobile Device Security)","NIST SP 800-188 (De-Identifying Government Datasets)","NIST Privacy Framework PR.DS-P2 (Data at rest and in transit protections)","GDPR Article 25: Data Protection by Design and by Default","GDPR Article 32: Security of Processing","RFC 8744 \u002F IETF ECH Standard (Encrypted Client Hello)","RFC 9162: Certificate Transparency Version 2.0","ETSI TS 102 223 (SmartCard \u002F SIM security relevant to 2G downgrade attacks)","published","2026-08-27T16:20:57.032958+00:00","2026-08-27T16:20:56.73+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fandroid-17-adds-ech-support-to-make-web-browsing-harder-to-track\u002F","android-17-adds-ech-support-to-make-web-browsing-harder-to-track-05b5b9","Android 17 adds ECH support to make web browsing harder to track",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",{"id":44,"name":45,"slug":46,"description":47,"color":48},"f43a7f30-5046-4b10-9dba-1a704139821e","Network Segmentation","network-segmentation","Lateral movement, flat networks, missing firewalls","#06b6d4",[]]