Android 17 Brings Encrypted Client Hello Network Privacy

Google is turning Android 17 into a privacy-focused release by baking Encrypted Client Hello (ECH) and other network protections directly into the mobile OS, making it the first major platform to deploy ECH at scale^{[2][4][5][8][12]}. The change aims to stop carriers, Wi‑Fi operators, and other intermediaries from profiling users based on the websites and apps they connect to, by hiding domain information that was previously exposed in every TLS handshake^{[2][5][8][10]}.

ECH is a TLS 1.3 extension that encrypts the Server Name Indication (SNI) field in the ClientHello message, which traditionally advertises the destination domain in plaintext to every network hop between a device and the server^{[1][6][7][13]}. With Android 17, the OS supports ECH by default and pairs it with Android’s Private DNS (DoH/DoT) so that both the DNS queries and the SNI-based metadata about visited domains are obscured from on-path observers^[2][9][13]. Even with ECH, intermediaries still see IP addresses and traffic volumes, but lose the fine-grained visibility needed to build browsing profiles or selectively throttle or block specific sites^[5][8][11].

For ECH to take effect, apps must target Android 17’s new API level 37 and use networking libraries that understand the extension, such as recent versions of HttpEngine, WebView, or OkHttp 5.5.0^{[1][3][4][6][11]}. Google’s documentation stresses that simply running on Android 17 is not enough: apps built against older SDK levels or using legacy HTTP stacks will continue to expose domain names the old way, leaving users unprotected for those connections^{[3][6][11][13]}. To help developers dial in their policies, Android 17 adds a domainEncryption element to Network Security Configuration, allowing ECH to be enabled, disabled, or required globally or for specific domains^[1][3][6]. Behind the scenes, new APIs such as DnsResolver.rawQuery make it easier for libraries to retrieve HTTPS DNS records that carry ECH configuration keys and feed them into Conscrypt’s TLS sockets and engines^[3][6].

The ECH rollout is part of a broader set of network safeguards in Android 17, including tighter controls on how apps reach into users’ home LANs^{[2][4][11][13]}. Google describes new access restrictions for local network resources designed to reduce the risk of apps quietly mapping or abusing devices on a home network, which has become an attractive target in phishing and malware campaigns^[2][13]. The release also introduces defenses against fraudulent digital certificates and builds in automatic blocking of 2G cellular connections, a legacy technology frequently abused by fake base stations and SMS fraud schemes to downgrade encryption and intercept traffic^{[2][4][10][13]}.

Security researchers have long warned that unencrypted DNS and SNI metadata give attackers and commercial surveillance operators a powerful side channel for monitoring user activity, even when application payloads are protected with HTTPS^[7][10][13]. By reducing that exposure at the OS level, Android 17’s ECH support raises the baseline for web privacy on mobile, while still coexisting with VPNs and other higher-layer protections enterprises may deploy^[2][5][8]. Google’s Android 17 security notes list several vulnerabilities fixed in the release, but none specifically tied to the new ECH implementation, and there are no public reports of exploits targeting the feature so far^[14]. Organizations rolling out Android 17 should encourage developers to adopt ECH-capable networking libraries, configure domainEncryption appropriately, and pair the feature with Private DNS and the new local and cellular network protections to get the full security benefit^{[1][2][3][6][9][11][13]}.

References

1. Behavior changes: Apps targeting Android 17 or higher
2. 4 new ways Android is protecting your network connections
3. Adopting Encrypted Client Hello (ECH) | Security
4. Android 17 Adds Encrypted Client Hello, Local Network Protection, and Automatic 2G Blocking
5. Google Deploys Support For Encrypted Client Hello On …
6. Fonctionnalités et API
7. Android 17 Launched, What New Privacy/Security Features Does it …
8. Android 17 Encrypted Client Hello Stops ISP Tracking
9. Android 17 Enables Encrypted Client Hello to Enhance …
10. Android 17 has some new tricks to keep your web traffic private
11. Android 17 hides the sites you visit, but not in every app
12. Android Developers
13. Android 17 enhances communication privacy, supporting ECH …
14. Android 17 Security Release Notes