- Published on
Google’s Android 17 Turns On New Privacy Feature—But Your Browsing Isn’t Fully Hidden
- Authors
- Name
- DeepHorus
Google has launched a significant privacy enhancement in Android 17 with the activation of Encrypted Client Hello (ECH), marking a major step in securing mobile internet traffic. This update, detailed in a security announcement, aims to shield a crucial piece of data from network observers. The company describes it as the first broad rollout of ECH on a major mobile operating system, developed in collaboration with its Jigsaw team and external developers.
The core problem ECH addresses is a long-standing privacy gap in HTTPS connections. While web page content is encrypted, the initial connection handshake still reveals the destination website's name in cleartext via the Server Name Indication (SNI). This allows internet service providers, Wi-Fi operators, and other network intermediaries to log every site a user visits.
ECH encrypts this SNI field, so only the destination server can decrypt it and see the true domain name. Intermediaries along the path see only a meaningless, encrypted label. This protection builds upon private DNS, which already masks the translation of a domain name into an IP address.
However, the feature's effectiveness currently has significant limitations. ECH only protects connections to websites and apps that have actively enabled the technology. Google is urging developers to adopt the OkHttp 5.5.0 library to implement ECH. Until widespread adoption occurs, requests to non-supporting destinations will still expose the domain name to the network.
Furthermore, network observers can still see the destination server's IP address and the volume of data transferred. This metadata can allow for coarse inferences about user activity, even when the specific domain name is hidden. The encryption secures the label, but not the fact that a connection exists.
This network-level privacy move coincides with legal battles over device-level privacy. A case involving activist Samuel Tunick, charged for allegedly using a duress password in GrapheneOS, raises questions about user control over data on a phone. Tunick expressed hope that the case would affirm that 'the government doesn't own our data.'
Beyond ECH, Android 17 also enables Certificate Transparency by default and mandates that apps seek user permission before scanning local networks. These additional measures further bolster the platform's security posture.
Looking ahead, the true impact of ECH will depend on developer and website adoption. Google is pushing for this upgrade, but the technology offers only partial anonymity. It represents a strong, built-in defense against passive network snooping, yet underscores that comprehensive online privacy requires both platform features and ecosystem-wide cooperation.
