Android 17 hides which websites you visit from your Wi-Fi and mobile provider
Google's next Android release turns on Encrypted Client Hello by default, blocks silent local network scans, and lets carriers switch off the ageing 2G network that fraudsters abuse.
Key points
- Android 17 will turn on Encrypted Client Hello (ECH) by default for apps that use modern networking libraries, hiding the name of the website you visit from your internet provider.
- Chrome 117 and Firefox 119 already support ECH inside their browsers; Android 17 pushes the protection down to the whole phone.
- Apps must now ask permission before scanning devices on your home Wi-Fi, closing a long-standing privacy gap.
- Participating mobile carriers can automatically switch off 2G on subscribers' phones to block SMS blasters and fake cell towers.
- Google's Jigsaw team tested the new system against the top 10,000 websites across 740 providers in 202 countries and found no breakage.
Google is rolling out a batch of network privacy changes in Android 17 that, taken together, make it much harder for internet providers, café Wi-Fi operators and nearby criminals to see what you do on your phone.
The headline feature is called Encrypted Client Hello, or ECH. It plugs a long-known leak in the way phones connect to secure websites.
What does Encrypted Client Hello actually do?
It hides the name of the website your phone is trying to reach. Today, even when you visit a site over HTTPS (the padlock connection that stops anyone reading the page contents), the very first message your phone sends still contains the site's name in plain text. Your provider can log it and sell profiles built from it.
ECH encrypts that opening message. To the network, every connection looks like generic traffic to a large hosting provider, not to a specific bank, dating app or news site.
The feature is a privacy extension for TLS, the standard that powers HTTPS, and it was first reported by BleepingComputer as part of Google's Android 17 preview.
Android users on Chrome 117 or later, or Firefox 119 or later, already get ECH inside those browsers. Android 17 pushes it down to the operating system, so any app built on the standard networking tools (OkHttp, WebView or HttpEngine) inherits it automatically.
What happens on sites that don't support it?
Android still pretends they do. The phone sends a decoy field called ECH GREASE that looks identical to a real encrypted hello. That way, a snooping network cannot single out ECH users as unusual or interesting.
Google's Jigsaw unit, which works on anti-censorship tools, ran that decoy traffic against the world's 10,000 busiest domains across 740 different internet providers in 202 countries. Nothing broke.
The other Android 17 network changes
Three more shifts land alongside ECH. Each is small on its own. Together they close doors that have been quietly open for years.
| Change | What it does | Who it protects you from |
|---|---|---|
| Local Network Protection | Apps must ask permission before scanning your home Wi-Fi | Nosy apps mapping your printers, cameras and smart bulbs |
| Certificate Transparency on by default | Website certificates must appear in public logs | Attackers using forged certificates to impersonate real sites |
| Optional 2G shutdown | Carriers can switch off the old 2G network per subscriber | SMS blasters and fake base stations parked near you |
The 2G change matters more than it sounds. Criminals drive around with suitcase-sized devices called SMS blasters that impersonate a mobile tower, force nearby phones to drop to 2G (because 2G has almost no authentication), and then push fake bank or delivery texts straight to the handset. Turn 2G off, and the attack fails at the first step.
Does any of this replace multi-factor authentication?
No, and Google is not claiming it does. ECH hides metadata about where you go. It does not stop a phishing site from stealing your password if you type it in, and it does not stop session cookies being lifted from a compromised device. Multi-factor authentication, ideally a passkey, is still what stops the account takeover at the end of that chain.
What Android 17 does do is take away the easy commercial surveillance that has quietly funded the mobile ad economy, and remove a few of the cruder tools criminals use on public networks. That is a good week's work.
