Google has introduced platform-wide support for Encrypted Client Hello (ECH) on Android 17, making it the first major mobile operating system to adopt the internet standard. ECH is designed to close a critical privacy gap, according to Jigsaw, a tech incubator within Alphabet. Even when users visit a site over secure HTTP, internet service providers can still see the domain names of the websites and services being accessed. That information can be used to build user profiles for targeted advertising, and bad actors can exploit it for phishing campaigns. The feature is enabled by default on Android 17.
With ECH enabled, the destination website a user visits is encrypted from the start. Internet service providers will only be able to see a website's content delivery network, such as Cloudflare, and the amount of data being transferred. They will not be able to see the specific website or app the user is on. This adds a layer of protection to user data and prevents tracking of online activities. Jigsaw stated that closing this privacy gap makes the internet safer for everyone.
Jigsaw noted that ECH alone is not a complete privacy solution. The standard will not conceal DNS lookups, which is the process of translating a web URL into a numerical IP address that computers recognize. Users would need to enable encrypted DNS separately to hide that information. ECH also does not hide a user's IP address, a function typically provided by a VPN.
The rollout of ECH is part of a broader set of security features Google has recently added to Android 17. One of these features is a zero-click solution that carriers can use to turn off 2G by default. This is intended to prevent SMS blasters, which often rely on the legacy cellular network to bypass modern spam filters. The feature gives carriers a tool to limit a known vector for unwanted messages.
The new operating system's privacy enhancements come amid ongoing concerns about how internet service providers and other third parties track user behavior. By encrypting the destination of web traffic, Google is addressing a gap that has persisted even with the widespread adoption of HTTPS. The move positions Android 17 ahead of other mobile platforms in offering this level of built-in traffic protection.
More software news from TechManNews.
