Android 17 Bolsters User Privacy with Encrypted Client Hello and Certificate Transparency

Google's Android 17 mobile operating system has introduced several new privacy features to protect users' online activity. One of the key additions is Encrypted Client Hello (ECH), a protocol that encrypts the site name, hiding it from the network carrying the request.

This means that only the destination server can read the site name, and other nodes on the network will see a meaningless label instead. However, ECH only protects traffic to destinations that have adopted it, and Google is pushing developers to upgrade to OkHttp 5.5.0 and enable the feature.

While this new protocol provides some level of protection, it's worth noting that the network still sees the destination server's IP address and the volume of data moving, allowing an observer to infer activity at a coarse level even when the name is hidden.

Android 17 also turns on Certificate Transparency by default and requires apps to ask permission before scanning a local network. This move comes as Android's device-level privacy meets its own test in court, with a recent case raising questions about who controls the data on a phone.