The promise is clear: that internet service providers and other observers will not be able to see which domains you visit, even when the connection is HTTPS. Until now, encryption protected the content, but not the connection metadata, such as the server name. With ECH, that data is also encrypted, closing one of the last privacy gaps in browsing.
How does ECH work on Android 17?
The HTTPS protocol encrypts the content traveling between your device and the server, but during connection establishment, the Server Name Indication (SNI) field is transmitted in plain text. This field reveals the domain you are connecting to, and any intermediary on the network can read it. ECH encrypts this initial handshake message , so the domain name is hidden from the very first millisecond.
For ECH to work, it's combined with a private DNS. This way, the system encapsulates the domain name, and only the destination IP address is visible. Network operators can only log traffic to that IP address , without knowing whether you're accessing a news outlet, your bank, or a messaging app.
What does ECH mean for user privacy?
With ECH enabled, browsing becomes much more opaque to external observers. It's no longer possible to profile browsing habits based on visited domains. Furthermore, by being integrated at the platform level, Android 17 becomes the first smartphone platform to deploy native support for ECH.
This measure is accompanied by other security barriers and network protections , such as mandatory permission for apps to scan local networks and new tools for operators to detect vulnerabilities in the 2G network. However, the effective reach of ECH will depend on adoption by servers and developers.
The arrival of ECH in Android 17 represents a significant step forward for mobile privacy, although its success will depend on collaboration across the entire industry. Users, for their part, can already enjoy a more opaque browsing experience, less visible to operators and other observers.
