Google has taken another step in protecting the privacy of Android users with the arrival of Android 17. The new version of the operating system includes the Encrypted Client Hello (ECH) protocol as a standard feature , a technology that prevents network operators and attackers from seeing which websites a person visits, even when the connection is encrypted using HTTPS. This measure, which was already available in secure, privacy-respecting web browsers , now extends to the entire system, representing a significant advance in the fight against tracking and phishing campaigns.
The announcement, made by the company via its official blog, details a set of security enhancements that go beyond ECH. The update also includes local network protection, Certificate Transparency (CT) enabled by default, and the ability for operators to disable 2G connections to prevent attacks via rogue base stations, known as 'SMS blasters'. All these features aim to strengthen user security and privacy at a time when digital threats are becoming increasingly sophisticated.
What is Encrypted Client Hello and how does it work?
The ECH protocol was created to address a security vulnerability that has existed since the beginning of the HTTPS era. Although web page content is encrypted, the domain name being visited remains visible to network operators and anyone who intercepts the communication. This information, transmitted in the initial part of the TLS protocol (known as ClientHello), has been used for years to create user profiles, fuel phishing campaigns, and carry out targeted scams.
ECH encrypts the domain name from the outset , ensuring that only the destination server can decrypt it. To achieve this, the client generates two ClientHello messages: a real one containing the actual information, and a decoy with a generic name. The real message is encrypted using a public key previously published by the server and is hidden within the decoy message. This way, any external observer only sees the decoy, which doesn't reveal the website being visited.
This mechanism, which is complemented by the use of DNS in Android to improve privacy , ensures that internet providers and network operators cannot easily determine which pages the user is accessing. However, there is an important caveat: ECH only works if the destination server also supports it . To prevent protected connections from being distinguished from unprotected ones, Android 17 includes the ECH GREASE feature by default, which sends random, fake extensions to unsupported sites, making all requests appear identical.
More protections: local network, certificates and 2G
In addition to ECH, Android 17 introduces three other security measures that strengthen user privacy in different areas. The first is local network protection , which requires apps to request permission before scanning for or connecting to other devices on the same Wi-Fi network. Until now, any app could see which other devices (TVs, cameras, game consoles) were connected to the home router, allowing for the creation of detailed profiles of the home and its occupants. With this new policy, developers must use a system selector so users can choose the device they want to connect to, without the app having access to the rest of the network.
The second measure is Certificate Transparency (CT) , which is now enabled by default. This feature requires that all digital certificates verifying the authenticity of a website or application be registered in a public registry. This way, if an attacker attempts to create a fake certificate to intercept traffic, the anomaly would be quickly detected, as the certificate would not appear in the registry. This protection significantly reduces the risk of man-in-the-middle attacks and makes it more difficult for cybercriminals to impersonate legitimate sites.
Finally, Google has implemented a solution that allows network operators to disable the default 2G connection for their users. This measure addresses the threat posed by fake base stations, also known as 'SMS blasters,' portable devices that emit high-power signals to force mobile phones to connect to 2G networks, which lack the anti-spam and anti-fraud filters of 4G and 5G networks. Once a device is on a 2G network, attackers can send phishing messages directly to the user or intercept their communications.
The role of developers and the adoption of ECH
One of the keys to making ECH effective is that application developers implement it in their products. Google has announced that OkHttp, the popular open-source HTTP client, now integrates ECH support in version 5.5.0, allowing third-party applications to easily take advantage of this technology. The company recommends that developers update their applications to this version and enable the feature so that users can benefit from the protection.
In addition, Google has worked with its Jigsaw division, which specializes in privacy and anti-censorship, to test the effectiveness of ECH GREASE. The tests were conducted on the 10.000 most visited domains worldwide, across 740 internet service providers in 200 countries, and no loading problems or unexpected blocks were detected. This demonstrates that the technology is reliable and does not negatively impact the user's browsing experience.
It's important to note that ECH is not a universal protection . It only works when both the application and the destination server support it. If the server is not compatible, the domain name will still be visible, even though the connection will be made through the ECH GREASE decoy, making it difficult for external observers to identify which connections are protected and which are not. Furthermore, ECH does not hide the server's IP address or the volume of data transmitted, so an observer could infer user activity at a more general level.
Context and availability
The arrival of ECH in Android 17 comes after major browsers like Chrome and Firefox incorporated this technology in their 2023 versions. However, the operating system-level integration represents a significant step forward, as Android 17 becomes the first major mobile operating system to offer widespread support for ECH . This means users will be able to benefit from protection across all their apps, not just their browser.
The Android 17 update has already begun rolling out to Pixel devices and is expected to reach other manufacturers in the coming months. Google hasn't specified which carriers will participate in the program to disable 2G by default, but the measure is designed so that users don't have to do anything to be protected. Users who want to check if ECH is working correctly can visit the Cloudflare website and verify that the 'sni' field appears as 'encrypted'.
In short, Android 17 represents a significant step forward in protecting the privacy of mobile users. The combination of ECH, local network protection, Certificate Transparency, and the default disabling of 2G provides a comprehensive security layer that makes tracking, phishing, and attacks via fake base stations more difficult. While the adoption of ECH by servers and applications will be gradual, the technological foundation is now in place for users to browse with greater peace of mind and control over their data.
