Overview
- Android 17 adds OS-level support for Encrypted ClientHello, which encrypts the TLS ClientHello message so the destination domain name is hidden from on-path network observers when used with private DNS.
- Jigsaw will enable ECH GREASE by default so connection attempts look similar whether a server supports ECH or not, reducing the risk that ECH adoption itself can be fingerprinted.
- App developers must upgrade to OkHttp 5.5.0 and enable ECH in their network stacks for Android apps to use the new protection, and websites and servers must also publish ECH keys for the feature to work.
- The release also gives carriers the option to disable 2G by default to block downgrade and SMS blaster attacks, enforces Local Network Protection so apps must request permission before scanning home networks, and tightens Certificate Transparency logging.
- Users will only see stronger privacy if apps, servers, and carriers adopt these measures, so watch for OkHttp upgrades, server ECH rollout, and carrier 2G default settings to judge real-world impact.