Android 17 Rolls Out ECH Privacy Feature, But Traffic Still Exposed

Google has rolled out its Android 17 update, which includes a new privacy feature called Encrypted Client Hello (ECH). ECH encrypts the domain name sent when a connection opens, hiding it from network carriers and snoops. This means that only supported websites and apps will have their traffic protected.

The rollout is seen as a major step in improving user privacy on mobile devices. Android 17 also includes Certificate Transparency by default, which requires apps to ask permission before scanning local networks.

However, it's worth noting that ECH only protects traffic to destinations that have adopted the feature. This means that users will still be able to infer activity at a coarse level even when the name is hidden. Google is pushing developers to upgrade to OkHttp 5.5.0 and enable the feature.

This move comes as Android's device-level privacy faces its own test in court, with an American charged under federal law for allegedly using a hardened Android build that wipes the device when a code is entered.