Google Android 17 introduces system-wide ECH encryption to enhance user privacy

Google has announced several network security upgrades for Android 17, most notably the system-wide integration of the Encrypted Client Hello (ECH) standard. Developed in collaboration with Jigsaw, ECH aims to close a long-standing privacy gap by encrypting the domain name during the initial TLS handshake. This prevents internet service providers (ISPs) and network eavesdroppers from seeing which specific websites or apps a user is accessing, even when using HTTPS.

To ensure compatibility and prevent fingerprinting, Android 17 will implement ECH GREASE, which sends randomized, fake ECH extensions to servers that do not yet support the standard. For the protection to be fully effective, apps must target Android 17 (API level 37) or higher and utilize compatible networking libraries such as OkHttp 5.5.0.

Other security features in Android 17 include:

• Local Network Protection: Requires apps to obtain explicit user permission before scanning or connecting to other devices on a local Wi-Fi network. • Certificate Transparency: Enforced by default to ensure website certificates are publicly logged, reducing the risk of rogue certificate authorities. • 2G Protection: Allows carriers to disable outdated 2G connectivity by default to mitigate SMS blaster attacks and phishing scams that force devices onto insecure legacy networks.