Android 17 hides website names from ISPs with new encryption standard

Google Alphabet Inc. ↗ 3.25% on Thursday confirmed that Android 17 will be the first major mobile operating system to ship with platform-wide support for Encrypted Client Hello, a privacy standard that hides the names of websites users visit from internet service providers and other network observers.blog+1

How ECH Works

Even when a connection is encrypted with HTTPS, the domain name of a destination website is transmitted in plaintext during the initial handshake between a device and a server — visible to anyone monitoring the network. "This unencrypted data can be used to build user profiles or, in the hands of malicious actors, leveraged for targeted phishing and scam campaigns," wrote Google software engineer Bram Bonné and Android product manager Shuaibo Huang in a blog post announcing the feature.blog

ECH addresses this by encrypting the destination website name using a secret key that only the intended server can unscramble. With the standard active, an ISP would see only a site's content delivery network, such as Cloudflare, and the volume of data moving — but not the actual website or app a user is accessing.engadget

The protection requires that websites and apps also support ECH on their end. To avoid making ECH-protected connections stand out from unprotected ones, Android 17 will enable ECH GREASE by default, which sends randomized fake ECH extensions to sites that have not yet adopted the standard, making all connection requests look identical. Google said it is partnering with Jigsaw, an Alphabet tech incubator, along with industry leaders and app developers to accelerate ECH adoption. Developers can enable ECH by upgrading to OkHttp 5.5.0.forbes+2

Broader Security Updates

ECH is one of four new network security measures shipping with Android 17. The update also allows mobile carriers to disable 2G connectivity by default, a move aimed at countering SMS blaster attacks that force nearby phones to drop LTE or 5G connections and downgrade to the less secure legacy network. Android 17 additionally enforces Local Network Protection, requiring apps to request permission before scanning or connecting to other devices on a local network, and introduces Certificate Transparency, which mandates that all certificates be logged in a public registry to make forged certificates harder to deploy undetected.9to5google

Limitations

ECH does not conceal DNS lookups — the process of translating a URL into a numerical IP address — though pairing it with encrypted DNS closes that gap. It also does not hide a user's IP address in the way a VPN does.engadget