CybersecurityPrivacy & Surveillance

Android 17 Bolsters Browsing Privacy with ECH Support

Analyst 207||Source: BleepingComputer
Smartphone on a table with screen on, showing a blurred webpage in a minimalist room with soft daylight.
“This new privacy standard works in tandem with private DNS to obscure the domain names you visit, hiding metadata that can be used to profile you,” reads Google’s announcement.

Encrypted Client Hello (ECH) and private DNS

Android 17 adds support for Encrypted Client Hello (ECH), a privacy extension to TLS designed to hide the hostname that normally appears in the Server Name Indication (SNI) during the start of a connection. According to Google, ECH “encrypt[s] the opening part of the TLS handshake that reveals the contacted hostname via the Server Name Indication (SNI),” and operates together with private DNS to obscure visited domain names from network observers. The change is framed as a defense against commercial profiling: the company points out that “Even if the connection to a website or service is secure, internet service providers (ISPs) and Wi‑Fi operators can still see the destination, which can be collected for commercial profiling purposes.”

Platform-level deployment in Android 17

Google is not leaving ECH to individual browsers. The company says Android 17 “incorporates the protection at the platform level,” and that users will benefit when browsing with Chrome 117 and later or Firefox 119 and later. Android 17 will enable ECH by default for apps that target the release, provided those apps use a compatible networking library — Google lists the latest versions of OkHttp, WebView, or HttpEngine as examples. On servers that support ECH, Android will encrypt the hostname; on servers that don’t, Android will still send a deliberate placeholder so real ECH connections do not stand out.

ECH GREASE and the Jigsaw field tests

To avoid making non‑ECH connections obvious, Android will send a fake ECH‑looking field called ECH GREASE when servers do not support the protection; the hostname remains visible in those cases. Google’s Jigsaw team tested ECH GREASE broadly: the unit evaluated it against the top 10,000 domains and across 740 internet providers in 202 countries and “found no site‑loading issues or unexpected network blocks.” The aim, Google says, is to prevent transport‑level fingerprinting of which clients support ECH while preserving compatibility where servers have not yet adopted the standard.

Local Network Protection, Certificate Transparency, and 2G controls

Android 17 bundles other network protections alongside ECH. Local Network Protection now requires apps to ask permission before scanning for or connecting to devices on a user’s local network. Certificate Transparency is enabled by default, meaning website certificates must appear in public logs and making forged certificates more evident. Separately, Google said participating mobile operators will be able to turn off 2G automatically for subscribers, a measure it links to reducing exposure to “SMS blasters and rogue base stations that can deliver malicious messages or capture sensitive traffic from nearby devices.”

What this means for technologists, mobile operators, and end users

  • Technologists and security teams: platform‑level ECH means application developers and library maintainers should confirm use of compatible networking libraries (for example, the latest OkHttp, WebView, or HttpEngine) if they want default encryption of the client hello for apps targeting Android 17.
  • Mobile operators: participating operators now have the technical option to turn off 2G automatically for subscribers, a change Google frames as reducing exposure to certain wireless threats; operators will therefore be deciding whether and how to apply that capability to their customer base.
  • End users: browsers that already support ECH (Chrome 117+, Firefox 119+) gain an extra layer when paired with Android 17, while apps targeting Android 17 will get ECH by default if they use compatible libraries; users should also expect more explicit permission prompts for local network scanning and see wider enforcement of Certificate Transparency.

Google frames these changes as a package: encrypt the initial TLS handshake where possible, avoid making non‑encrypted handshakes stand out, require explicit local‑network permission, make certificates publicly auditable, and give operators a way to retire 2G. Together, the moves aim to reduce easy visibility into where devices connect and to tighten a few long‑standing weak points in mobile networking. Jigsaw’s cross‑provider tests and Google’s decision to push ECH into the platform suggest the company expects server‑side adoption to grow rather than stall — but Android will still reveal hostnames when servers do not yet support ECH, even as it sends ECH GREASE to blend in.

Source: BleepingComputer — Android 17 adds ECH support to make web browsing harder to track

GoogleMobile SecurityAndroid 17TLSPrivacy FeaturesEncrypted Client HelloECHPrivate DNSBrowsing Privacy
Related Intelligence

Continue Reading

Modern industrial control room with computer terminals and monitoring systems on a wall, from a slightly elevated view.

ICS Threats Decline, But Biometrics Sector Remains Vulnerable

The threat landscape for industrial control systems (ICS) is showing a welcome decline, with only 19.15% of ICS computers encountering blocked malicious objects in Q2 2026 - the lowest level since 2022. However, amidst this positive trend, one sector remains alarmingly vulnerable: biometrics.

Analyst 207
Network operations center with analysts monitoring internet traffic and network visualizations on multiple screens.

Federal Agencies Face Shrinking Window to Defend Against Cyber Threats

The threat landscape has drastically changed: cyber attackers can now exploit vulnerabilities in as little as two days, leaving federal agencies with a shrinking window to defend against threats. To stay ahead, they must shift their focus from reacting to attacks to anticipating and preparing for what's next.

Analyst 207
Employees work at desks in a brightly-lit office with computer equipment and networking devices, hinting at security…

Threat Research Bolsters SMB Cybersecurity with MDR

With ESET's Managed Detection Response (MDR), small and midsize businesses can tap into expert-driven threat monitoring and hunting capabilities, leveling up their cybersecurity game without needing an elite in-house team. This game-changing approach bridges the gap between threat research and real-world defense, empowering organizations to stay one step ahead of threats.

Analyst 207
Security analysts collaborate around a large screen and conference table in a brightly lit operations center.

AI Adoption Surges in Security Operations

With cyber threats escalating and bad actors already leveraging AI, a surge in AI adoption is underway in security operations, driven by the urgent need to stay ahead. The stark reality: teams are drowning in alerts, with an average of 100+ daily, and struggling to keep pace with the sheer volume.

Analyst 207