How Android 17 stops network snoops and SMS blasters now - with ECH and a 2G kill switch

Follow ZDNET: Add us as a preferred source on Google.

According to Google, Android 17 offers a few new ways of keeping your connections secure and private. On Thursday, the company announced that Android 17 is the first mobile operating system to support Encrypted Client Hello (ECH), a TLS privacy feature that hides destination domain names. The release also enforces new local-network permissions and enables Certificate Transparency by default. The new Android version also enables telecoms to block their phones from often malicious 2G access points.

But what is ECH, and how do these protections secure your browsing? Let's break it down.

HTTPS has long encrypted the contents of web sessions, but it doesn't hide the website hostname you're visiting. That information was exposed in the Server Name Indication (SNI) field of the TLS ClientHello handshake. This gave ISPs, Wi-Fi operators, corporate networks, and unauthorized snoopers a way to identify sites and services you were visiting, even when they couldn't read the connection's content.

Adding ECH support in Android 17 encrypts SNI in the opening TLS handshake.

"By encrypting the destination website name from the very start, ECH helps ensure that, for supported websites and apps, network providers and network snoopers can no longer easily see which websites or apps you are accessing," Google explained, especially used alongside Android's Private DNS feature .

Also: How to turn on Private DNS Mode on Android - and why it's a must for security

The qualification -- "for supported websites and apps" -- matters. Android's developer documentation says ECH is supported by default on Android 17, API level 37 , and later, but an application needs an ECH-capable networking library. Developers can configure the protection through Android's Network Security Config, while network libraries must retrieve ECH configuration data from DNS HTTPS records and set it before beginning the TLS handshake.

Google specifically advised developers to upgrade to OkHttp 5.5.0 and enable ECH. When a destination server does not support ECH, Android's documented approach includes ECH GREASE . This mechanism makes protected connections harder to spot while permitting a conventional TLS connection when necessary.

That said, ECH is not a VPN, and it does not erase all traffic metadata. Network observers may still see a device's destination IP address, timing, traffic volume, and the broad hosting or content-delivery network involved. ECH also does not hide DNS requests, which is why its privacy value depends heavily on pairing it with encrypted DNS, such as Private DNS .