Android 17 adds ECH support to make web browsing harder to track

Android 17 adds support for Encrypted Client Hello (ECH), a privacy extension to TLS that encrypts the Server Name Indication (SNI) field in the TLS handshake, which normally reveals the destination hostname. This prevents network providers and snoopers from profiling users based on visited domains. ECH is enabled by default for apps targeting Android 17 using compatible networking libraries. For servers without ECH support, Android sends a fake ECH field (ECH GREASE) to avoid distinguishing real ECH traffic. Google also enhanced local network protections by requiring app permissions for scanning or connecting to local devices, enabled Certificate Transparency by default to detect forged certificates, and enabled participating mobile operators to disable 2G to mitigate risks from rogue base stations and SMS-based attacks.

The primary impact is improved user privacy and security by reducing the ability of network observers to track visited websites via TLS handshake metadata. This reduces profiling and potential surveillance risks. Additional protections reduce risks from local network scanning by unauthorized apps, forged TLS certificates, and attacks exploiting legacy 2G cellular networks. There are no reported exploits or active attacks related to these changes.

These protections are integrated into Android 17 and enabled by default for compatible apps and browsers. Users should update to Android 17 and use updated apps that support ECH to benefit from these privacy enhancements. No additional user action is required. Network operators and app developers should ensure compatibility with ECH and respect new permission requirements for local network access.