"This new privacy standard works in tandem with private DNS to obscure the domain names you visit, hiding metadata that can be used to profile you," Google's Bram Bonné and Shuaibo Huang said.
Encrypted Client Hello (ECH) on Android 17
Google announced that Android 17 will include support for Encrypted Client Hello (ECH), a TLS privacy standard designed to stop network observers from seeing which websites a user is visiting. Jigsaw, Google's research division, explained that ECH hides the domain name by encrypting it with a secret key that only the destination website can decipher. The change moves the protection from browser-specific implementations into the operating system itself.
ECH GREASE and default behavior
Jigsaw warned that "not all web servers will offer ECH support," and recommended ECH GREASE — a technique that "sends fake, randomized ECH extensions to sites that don't support ECH — so that every connection request looks the same." Google is making ECH GREASE the default in Android 17, a choice intended to avoid signaling which connections are protected and which are not. Browser vendors have already shipped ECH support in recent versions: Google Chrome in version 117 and Mozilla Firefox in version 118; Android 17 expands the protection to the entire OS.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleOkHttp brings ECH to third‑party apps
Jigsaw also said OkHttp, the open-source HTTP and HTTP/2 client library widely used on Android, has integrated ECH support into its core. That integration "allows third-party Android app developers to leverage the new capability," meaning apps that rely on OkHttp can, in principle, participate in the OS‑level hiding of destination domains without bespoke implementation in each app.
Local Network Protection: permissions for home networks
Alongside ECH, Google is enforcing Local Network Protection in Android 17. Under the new rule, apps must ask for users' permission before they can scan or connect to other devices on the local network. That change is explicitly aimed at "safeguard[ing] the privacy of users' home networks" by making network enumeration and local device access an explicitly granted action rather than an implicit capability.
Certificate Transparency and 2G disablement for carriers
Android 17 also enables Certificate Transparency (CT) by default, which "mandates that all websites be logged in a public registry," increasing public visibility into which TLS certificates are issued for which domains. Separately, Google said Android 17 will allow telecom operators to turn off 2G by default for their subscribers to prevent downgrade attacks and mitigate exposure to rogue base stations or SMS blasters that can send malicious text messages or capture traffic from nearby devices. Google characterized the carrier option as a "zero-click solution" compared with prior controls: Android 12 offered a manual hardware-level option to disable 2G, and Android 14 added a security feature allowing IT administrators to turn off 2G support on managed devices. "For participating carriers, this helps eliminate the legacy attack surface out of the box, proactively mitigating a primary method used by SMS blasters before they can target your device," Google said.
What this means for technologists, carriers, and end users
- Technologists and security teams: App developers and platform engineers should note that OkHttp now carries ECH support in its core, which can simplify adoption. Teams responsible for TLS deployments should also remember Jigsaw's caveat that "not all web servers will offer ECH support" — server-side support remains a gating factor for end-to-end ECH protection.
- Carriers (telecom operators): The new option to turn off 2G by default gives participating carriers a way to reduce legacy downgrade attack surfaces at scale. Google frames this as a carrier-side choice that can be deployed without user action — a "zero-click solution."
- End users: With ECH at the OS level and ECH GREASE enabled by default, Android 17 intends to hide destination domain metadata from network providers and snoopers for supported sites and apps. Users will also encounter a clearer permission boundary for local network scans and connections, since apps must now request permission before interacting with devices on the home network.
Google's Android 17 bundles multiple network-privacy and cellular-security changes: OS-wide ECH to obscure domains, a default GREASEing strategy to avoid singling out ECH-protected connections, OkHttp integration for apps, enforced local-network permissions, default Certificate Transparency, and a carrier option to disable 2G. The benefits, as Google and Jigsaw note, depend on two external decisions beyond the device: whether websites and servers deploy ECH and whether carriers participate in the 2G disablement option. Those two adoption paths will determine how widely the announced protections change the visibility attackers or network operators have into users' connections.
Original story: https://thehackernews.com/2026/08/android-17-adds-os-wide-ech-to-hide.html
