In brief
- Android 17 adds platform support for Encrypted Client Hello, which encrypts the domain name sent when a connection opens so the network can't read the destination.
- Google describes the release as the first broad Encrypted Client Hello rollout on a major mobile OS, built with its Jigsaw team and outside developers.
- The protection covers only sites and apps that have switched Encrypted Client Hello on; a destination that hasn't still exposes its domain to carriers, Wi-Fi operators, and network snoops.
If you're an Android user, your internet browsing just got a little more private.
Google's mobile operating system Android 17 now turns on Encrypted Client Hello, a privacy standard that hides a web request's destination from the network carrying it. Google laid out the rollout in a security post published Wednesday.
A page loads over HTTPS, so its contents are scrambled. The handshake that opens the connection still names the site in cleartext through a field called the Server Name Indication. Every node between a phone and a server can read that field and log where a device goes.
Encrypted Client Hello, or ECH for short, seals the field. The client encrypts the site name to a key the destination publishes, and only that server can unwrap it. The rest of the path sees a meaningless label, not the domain. It runs on top of private DNS, which already hides the separate step that turns a name into an IP address.
ECH protects traffic only to destinations that have adopted it. Google's post limits the claim to "supported websites and apps," and the company is pushing developers to upgrade to OkHttp 5.5.0 and enable the feature. Until adoption spreads, a request to a site without ECH still shows its domain to the network.
The network still sees the destination server's IP address and the volume of data moving. An observer can infer activity at a coarse level even when the name is hidden. The encryption is a lock on the label, not on the fact that a connection happened.
Google's network-level move lands as Android's device-level privacy meets its own test in court.
Samuel Tunick, an Atlanta activist, became the first known American charged under federal law for allegedly using a duress password built into GrapheneOS, a hardened Android build that wipes the device when the code is entered. GrapheneOS said its software is "completely legal" and constitutionally protected as the case proceeds. A related prosecution has framed the dispute as a question of who controls the data on a phone.
“I just hope to send the message that the government doesn’t own our data,” Samuel Tunick told the New York Times in an interview published Friday.
Android 17 also turns on Certificate Transparency by default and requires apps to ask permission before scanning a local network.