Overview
- Google announced the change in early September, adding Encrypted Client Hello (ECH) to Android 17 so the initial TLS handshake no longer reveals the hostname a phone is contacting.
- Android 17 pairs ECH with Private DNS to hide both the connection target and the DNS lookups that previously let ISPs or hotspot operators infer visited sites.
- The system forces apps to ask users before scanning or talking to devices on a home Wi‑Fi, limiting silent discovery of TVs, cameras and other local hardware.
- Carriers can opt to disable legacy 2G by default on Android 17 to block downgrade attacks that let attackers push phones onto 2G and send phishing SMS past modern filters.
- Protections have clear limits: ECH only works if servers support it, certificate checks rely on public transparency logs, and users should still use HTTPS, disable unnecessary sharing on public Wi‑Fi, and consider trusted DNS or VPNs.