Android 17 Hides Website Names from Snoops with New Security Feature

Google has introduced a new security feature in Android 17 that hides the destination website name from network operators and eavesdroppers during a TLS handshake. This is achieved through the Encrypted Client Hello (ECH) protocol, which works with private DNS to obscure domain names. According to Google, even if a connection is encrypted by HTTPS, the domain names of visited sites are still visible to snoopers.

The company warns that this leak can be used for profiling, phishing, and scam campaigns. ECH therefore helps protect users from these types of attacks. Android 17 also enforces Local Network Protection, requires apps to ask permission before scanning or connecting to other devices on a home Wi-Fi network. Certificate Transparency is enabled by default, making it harder for issuers to log fake certificates.

In addition, Google has partnered with Jigsaw to enable broad ECH support in Android 17. The company notes that this makes Android 17 the first major mobile OS to do so. Google also suggests that app developers upgrade to OkHttp 5.5.0 and enable ECH. This will help protect users from potential threats.