Overview
- Android 17, announced Thursday, turns on platform support for Encrypted Client Hello (ECH) and uses Jigsaw testing of the top 10,000 domains and 740 ISPs in 202 countries to confirm minimal site breakage.
- ECH encrypts the TLS ClientHello (the SNI field) so ISPs and Wi‑Fi operators cannot read destination hostnames, though networks still see destination IP addresses and traffic volumes.
- The protection only applies when destination servers and client networking stacks support ECH, so Google is urging developers to upgrade libraries such as OkHttp 5.5.0 or compatible WebView/HttpEngine and to enable ECH GREASE to avoid making protected requests stand out.
- Android 17 also enforces Local Network Protection so apps must ask before scanning or connecting to LAN devices, enables Certificate Transparency by default to make forged certificates easier to detect, and offers carriers a zero‑click option to disable legacy 2G for subscribers.
- Users should see less network profiling and lower risk of 2G downgrade SMS attacks, but the real-world gains depend on broad server adoption, updated app libraries, and participating mobile operators turning on the carrier 2G disable option.