Overview
- Android 17, which Google announced on Thursday, August 27, 2026, enables platform-level Encrypted Client Hello (ECH) so supported sites and apps can hide the domain name in the opening TLS handshake.
- To prevent observers from spotting only ECH-protected connections, Google’s Jigsaw will enable ECH GREASE by default so clients send fake ECH-like fields to destinations that do not support the standard.
- Android 17 also enforces Local Network Protection so apps must ask before scanning or connecting to devices on your home Wi‑Fi and turns on Certificate Transparency by default to make forged certificates easier to detect.
- Carriers can opt into a zero-click setting that disables legacy 2G by default to reduce SMS-blaster and fake‑cell‑tower phishing attacks, while developers must upgrade networking stacks such as OkHttp 5.5.0 to use ECH in apps.
- The rollout gives immediate privacy gains for supported endpoints but still leaves IP addresses, timing and traffic volume visible and requires wider adoption by browsers, apps, CDNs and servers to deliver full benefit.