Android 17 encrypts website names by default and tightens local network access
Android 17 brings four network security changes that Google says make it harder for internet providers, Wi-Fi operators and attackers to see or tamper with what a phone is doing online. The most significant is platform-wide support for Encrypted Client Hello (ECH), which Google described in an Aug. 27 blog post as a first for a major mobile operating system.
Even on an HTTPS connection, the name of the website a device is contacting has traditionally been visible in the first message of the encrypted handshake. That lets anyone on the network path, from a coffee-shop hotspot to an internet provider, build a list of sites a person visits. ECH encrypts that part of the handshake.
What changes in Android 17
- Encrypted Client Hello: ECH is on by default for apps that target Android 17 and use a compatible networking library, such as current versions of OkHttp, WebView or HttpEngine, BleepingComputer reported. When a server does not support ECH, Android sends a decoy field so that real ECH connections do not stand out; in that case the site name is still visible. Chrome and Firefox on Android already supported ECH.
- Local Network Protection: apps now need the user's permission before scanning for or connecting to other devices on a home or office network. Google is steering developers toward a system picker for tasks like casting to a TV, so the app never sees the full device list.
- Certificate Transparency by default: website certificates must appear in public logs, making it harder for a fraudulent certificate from a compromised issuer to go unnoticed.
- Carrier-controlled 2G shutoff: participating mobile operators can switch off 2G for their subscribers by default, cutting off a route used by SMS blasters, fake base stations that push scam texts.
Google's Jigsaw unit said it tested the decoy approach against the top 10,000 domains and 740 internet providers in 202 countries without finding site-loading failures or unexpected blocking.
Why it matters
ECH protects only the sites and services that support it, and private DNS is needed alongside it to hide domain lookups. Its value will grow as more websites and content delivery networks adopt it. Some corporate networks and parental-control tools rely on reading site names to filter traffic, and they may need to adjust.
The 2G change depends on carriers opting in. Google did not name participating operators. Android 12 and later already include a manual switch to turn 2G off.
What to do
- Install Android 17 when it reaches your device and keep apps updated.
- Turn on Private DNS in network settings to pair with ECH.
- If you do not need 2G, turn it off under your SIM or mobile network settings.
