Google says Android 17 Encrypted Client Hello now hides the destination website name from the start of a TLS handshake. HTTPS already encrypts page contents. However, Google warns that even if the connection is encrypted by HTTPS, the domain names of the sites you visit are still visible to network operators and eavesdroppers. Google software engineer Bram Bonné and Android product manager Shuaibo Huang wrote that this leak can feed profiling, phishing, and scam campaigns.
ECH therefore works with private DNS to obscure those names. Google says that, for supported websites and apps, providers and snoops can no longer easily see which sites or apps a phone is reaching. The company also calls Android 17 the first major mobile OS to enable broad ECH support. In addition, it is doing that work with Jigsaw.
How Android 17 Encrypted Client Hello actually works
The protection is not universal. Instead, Android developer docs say apps targeting Android 17, API level 37, use ECH when the networking library and the remote server both support it. If ECH cannot be negotiated, the client then sends randomized ECH GREASE. Google’s security post tells app developers to upgrade to OkHttp 5.5.0 and enable ECH. Docs also add a new domainEncryption setting so apps can turn the mode on or off globally or per domain.
Three more Android 17 network defenses
Meanwhile, Android 17 now enforces Local Network Protection. Apps must ask before they scan or connect to other devices on a home Wi-Fi network. For casting, Google says developers should use a system picker so an app never needs to see every gadget in the house.
Certificate Transparency is also on by default. As a result, issuers must log certificates in a public registry, which Google says makes fake-certificate interception harder to hide.
Finally, Android 17 lets participating mobile carriers disable 2G by default. Google says fake base stations, often called SMS blasters, force phones onto weaker 2G so scam texts can skip modern filters. Android 12 already offered a manual 2G toggle. The carrier default therefore closes that gap without a tap.
This sits on the Android 17 software that already started reaching Pixel phones. Tech My Money covered that Android 17 Pixel rollout in June. Google has also been stacking scam defenses on the same OS, including tools aimed at bank scam calls.
