Google has announced a set of network security upgrades in Android 17 aimed at limiting what internet service providers, Wi-Fi operators, and other network observers can learn about a device’s traffic. The headline feature is platform-wide support for Encrypted Client Hello (ECH), a TLS privacy extension that encrypts the part of the handshake that normally reveals which hostname a device is connecting to.

Historically, even fully encrypted HTTPS connections leaked the destination site through the Server Name Indication (SNI) field during the TLS handshake, letting ISPs and Wi-Fi operators log and profile visited domains. ECH closes that gap by encrypting the SNI itself. Google says the feature works alongside private DNS to obscure domain-level metadata that has commonly been used for commercial profiling.

Browsers such as Chrome 117+ and Firefox 119+ already support ECH, but Android 17 moves the protection into the OS itself. It will be enabled by default for apps targeting Android 17 that use a compatible networking stack, including recent versions of OkHttp, WebView, or HttpEngine.

How it handles unsupported servers

For servers that support ECH, Android will encrypt the hostname as expected. For servers that don’t, Android sends a decoy field known as ECH GREASE so that genuine encrypted handshakes don’t stand out to observers, though in that fallback case the hostname remains visible. Google’s Jigsaw unit tested ECH GREASE against the top 10,000 domains across 740 internet providers in 202 countries and reported no site-loading failures or unexpected network blocking.

Additional protections

  • Local Network Protection: apps must now request explicit permission before scanning for or connecting to devices on a user’s local network.
  • Certificate Transparency by default: website certificates must appear in public CT logs, making forged or mis-issued certificates easier to detect.
  • Automatic 2G blocking: participating mobile operators can now disable 2G connectivity for subscribers, reducing exposure to SMS blasters and rogue base stations used to deliver malicious messages or intercept nearby traffic.

For security teams, the shift toward encrypted, OS-enforced hostname protection reduces the value of network-level traffic inspection for domain-based monitoring and threat detection, a tradeoff worth factoring into enterprise mobile device management and network monitoring strategies.