Android 17 Adds OS-Wide ECH and Network Security Protections
Summary
Android 17 adds OS-wide Encrypted Client Hello with ECH GREASE, requires permission for local network access, enables Certificate Transparency by default, and lets participating carriers disable 2G.
Key points
- Android 17 adds operating-system-wide Encrypted Client Hello (ECH), which can obscure destination website names for supported sites and apps.
- ECH works with private DNS; ECH GREASE is enabled by default to make connections to servers without ECH support appear similar.
- Google says OkHttp has integrated ECH support, enabling third-party Android app developers to use the capability.
- Local Network Protection requires apps to request permission before scanning or connecting to devices on a user's local network.
- Certificate Transparency is enabled by default, requiring websites to be logged in a public registry.
- Participating carriers can disable 2G for subscribers, helping reduce downgrade attacks and exposure to rogue base stations and SMS blasters.
Article Details
- Event Type
- Announcement of network security and privacy protections in Android 17
- Impact
- Android 17 adds operating-system-wide support for Encrypted Client Hello (ECH), enables ECH GREASE and Certificate Transparency by default, requires apps to request permission to scan or connect to devices on a local network, and allows participating carriers to disable 2G. These measures are intended to reduce network-observer visibility into website destinations, protect local-network privacy, and mitigate exposure to 2G-related downgrade attacks, rogue base stations, and SMS blasters.