Technology
Google adds Encrypted Client Hello default support to Android 17
The updated operating system obscures domain names during network handshakes and adds new cellular and local network safety measures.
The short version
- Android 17 becomes the first major mobile operating system to enable Encrypted Client Hello (ECH) by default, hiding visited domain names from network operators.
- The privacy feature requires app developers to update to OkHttp 5.5.0 and enable ECH for full implementation.
- Android 17 also includes tools allowing mobile carriers to turn off 2G networks by default and enforces permission prompts before apps can scan local networks.
Key facts
- Google implemented platform-wide default support for Encrypted Client Hello (ECH) in Android 17.[Engadget]
- Alphabet's Jigsaw stated that ECH encrypts the domain name during initial TLS handshakes, preventing internet service providers from seeing specific domain names, though it does not hide IP addresses or conceal DNS lookups on its own.[Engadget · 9to5Google]
- App developers must upgrade to OkHttp 5.5.0 and enable ECH to support the feature within their applications.[9to5Google]
- Android 17 allows mobile carriers to disable 2G connectivity by default to help counter SMS blaster attacks that attempt to downgrade connections to legacy networks.[Engadget · 9to5Google]
- The update enforces Local Network Protection, requiring applications to obtain user permission before scanning or connecting to local network devices.[9to5Google]