Android 17 Blocks Wi-Fi Tracking, Web
Google's Android 17 will have new network security, like default Encrypted Client Hello, to hide browsing domains and prevent tracking and phishing.
Google has introduced a suite of network security changes for Android 17, designed to hinder tracking and snooping by network operators and malicious actors. The updates target the exposure of domain names during encrypted HTTPS connections, which can be used to build user profiles or launch phishing campaigns.
According to Google software engineer Bram Bonné and product manager Shuaibo Huang, this unencrypted data is visible even with HTTPS. Android 17 closes this privacy gap with default support for Encrypted Client Hello (ECH), a standard that works with private DNS to conceal a connection's destination from outside observers.
ECH encrypts the domain name with a key only the destination server can unlock. Due to uneven ECH support among web servers, apps also send a decoy GREASE extension so observers cannot identify protected connections by their network shape. Google states Android is the first major mobile OS with broad ECH support and is collaborating with its Jigsaw unit and app developers to accelerate adoption.
"ECH support for Android is a huge step towards closing one of the largest remaining structural privacy holes left on the Internet," said Nick Sullivan, co-author of the ECH standard and founder of Cryptography Consulting LLC. For apps targeting Android 17, ECH is enabled by default if they use a supporting networking library like newer versions of OkHttp, WebView, or HttpEngine.
Deployment and Validation
Before the global rollout, Jigsaw conducted two validation tests. The first sent GREASE requests to the top 10,000 domains worldwide, with connection success rates matching ordinary TLS. The second test routed requests through 202 countries and 740 ISPs, including heavily filtered networks in Russia and China, and found interference remained near zero.
"Internet security must evolve continuously to match modern threats," noted David Kleidermacher, VP of Engineering for Android Security & Privacy. "Jigsaw’s ECH measurements helped validate deployment in Android 17, addressing a long-standing vulnerability."
Additional Security Protections
Beyond ECH, Google implemented three further changes in Android 17. Local Network Protection now requires apps to ask for permission before scanning or connecting to other devices on a local network, blocking a method used to profile a household via smart TVs and cameras. Certificate Transparency is enabled by default, forcing certificates into a public log to make forged ones harder to deploy unnoticed.
Additionally, participating mobile operators can now disable 2G for their subscribers without user action. This move aims to reduce exposure to SMS blasters, which are fake base stations that force phones onto insecure legacy networks to bypass spam filters with phishing texts. Google concluded that these protections work seamlessly in the background to maintain user privacy.
