Google announced that Android 17 has now started to enable Encrypted Client Hello ( ECH ) by default. This feature mainly operates during the network connection establishment phase, with the aim of reducing the ability of intermediaries such as operators and public Wi – Fi providers to directly read the user's access to target domains.
Hide only domain names.
In the traditional connection process, the name of the website that the user visits may be exposed to observers in the network path during the handshake phase. ECH will encrypt this part of the site name information, allowing only the target server to decrypt it; other nodes will no longer see the explicit domain name.
Google claims that this is the first large-scale deployment of ECH in mainstream mobile operating systems. This feature is built on a private DNS, which is already capable of hiding domain name resolution requests. Together, they can further reduce the amount of information visible on the network side.
Whether it takes effect depends on whether the website is integrated.
However, this protection does not cover all browsing activities. ECH is only effective for websites and applications that have enabled this standard. If the target site has not yet completed the integration, the domain name in the access request may still be seen by operators, Wi – Fi providers, or other network listeners.
- Websites that have integrated with ECH can hide their domain names.
- Sites that have not connected to ECH will still expose their domain names.
- Developers need to upgrade and enable the relevant support.
In its explanation, Google limited the scope of application to "supported websites and applications" and urged developers to upgrade to OkHttp 5.5.0 in order to expand the compatibility range.
IP The address is still visible.
Even if ECH is enabled, the network side can still see the IP address of the target server, as well as the approximate scale of data transmission. Although observers may not be able to directly read the domain name, they can still make a rough judgment about user activities based on IP and traffic characteristics.
This means that what ECH hides is "which domain name was accessed," not the act of a connection taking place itself. It enhances the level of privacy protection, but it does not completely remove browsing activities from being visible at the network layer.
Android 17 Synchronize and tighten permissions
Except for ECH, Android 17 also enables Certificate Transparency by default, and requires user permission before scanning the local network. This update from Google is not just about launching a single feature; it also involves tightening restrictions on connections, certificates, and local area network access permissions simultaneously.
