Google is directly integrating a privacy feature for web connections into Android 17. According to the company's statement on August 27th, the new system will support Encrypted ClientHello ( ECH ), which is used to hide the domain names of websites visited by users at the initial stage of connection establishment, thereby reducing the possibility of network operators, internet service providers, and bypass listeners from accessing such information.

Privacy gaps other than HTTPS

Google points out that many users may assume that HTTPS indicates that the connection is completely hidden, but this is not actually the case. HTTPS can encrypt the data transmitted between the browser and the website, but it does not automatically conceal the domain name of the visited target. In other words, even if the page content cannot be directly read, external observers may still be able to determine which website the device is connecting to.

The company stated that such unencrypted connection metadata can be used to create user profiles and may also be exploited by malicious actors for targeted phishing or fraud activities. Android The focus of this adjustment is to address this long-standing vulnerability.

ECH Encrypts domain names during the handshake phase

The function of ECH occurs during the initial handshake phase of the connection. As Google explains, this standard uses a key that only the target website can decode to encrypt the target domain name. In this way, when traffic passes through network nodes, it is not possible for outsiders to directly see which specific domain name the device is accessing.

Whether this capability is truly effective also depends on whether websites and applications support ECH. Google indicates that system-level support is just the first step; service providers and developers also need to integrate it in order for ordinary users to receive full protection.

Android 17 is enabled by default. ECH GREASE

Except for ECH, Android17 will also enable a supporting feature named ECH GREASE by default. This technology is promoted by Jigsaw with the aim of avoiding the situation where "only some connections use ECH", which could instead expose additional characteristics.

The approach of Jigsaw is to have applications and browsers send a randomized pseudo-ECH extension when accessing websites that do not currently support ECH. This way, from an external perspective, different connection requests will appear more similar, making it harder to distinguish protected connections through metadata.

For users, this means that even if the target website has not yet fully supported ECH, Android will still provide a default level of basic privacy protection first. Google This move is equivalent to bringing the domain name hiding capability down to the operating system level, rather than continuing to rely on individual browsers or applications to implement it separately.