Android 17 Encrypts Your Browsing Destinations, Hiding Them From Carriers and ISPs

Summary

Google shipped platform-wide support for Encrypted Client Hello (ECH) with Android 17, making it the first major mobile OS to implement the privacy feature at the OS level. ECH closes a gap in standard HTTPS connections: even on a fully encrypted website, the domain name you visit has always been visible to your carrier, ISP, and any network monitoring the connection. ECH wraps that hostname in encryption keyed only to the destination server, so the domain becomes invisible to anyone in between. The feature activates automatically for apps that use modern networking libraries, including WebView, OkHttp, and HttpEngine. Android 17 also ships automatic 2G blocking to prevent network downgrade attacks, and a new local network permission that prevents apps from scanning your home Wi-Fi without your knowledge. Google tested ECH across 202 countries and 740 ISPs and found near-zero interference, including on heavily filtered networks.

Why it matters

Most people assume an HTTPS padlock means private browsing. It does not. Before Android 17, your carrier could see every domain name you visited, even if the page content was encrypted. ECH seals that gap. Combined with a private DNS provider, Android 17 is meaningfully harder to surveil at the network level than any previous version.

HTD Says

Android 17 just closed a privacy gap that has existed since the beginning of HTTPS, and your carrier can no longer see the domain names of the sites you visit, which matters more than most privacy headlines because it happens automatically without any setting changes. This is a very meaningful update for those people concerned with privacy.

There are a lot more geeky details on this that Ghacks outlines in their coverage. But there is one important thing that I want to point out. This encryption is not guaranteed in any way, as numerous requirements must be met for a site to be enabled to handle it. And I believe the ISP has to honor it. And you have to have a site with all the configurations set.

From what I can understand, you will need: ECH Support, a compatible network library like OKHttp with ECH enabled, certificate transparency, and private DNS. I’m sure there is more, but just from reading that, I’m going to assume that only select sites will be doing this. And we would have to wait for Apple to do something similar.

Source:

Engadget