Android's New ECH Feature Hides Browsing History from ISPs, But There's Still a Gap

Google has implemented a new feature called Encrypted Client Hello (ECH) in its Android 17 update, which will hide browsing history from Internet Service Providers (ISPs). However, this does not completely protect users' online activities as it only works when the website supports ECH. Most web servers currently do not support ECH, and even if they did, the IP address would still be visible to ISPs.

NordVPN can fill in this gap by encrypting internet traffic and masking IP addresses. The company's Basic plan is available for $3.49/month on a 2-year subscription, which includes applications for multiple devices, browser extensions, and router installation for whole-household coverage.

ECH works by wrapping the Server Name Indication (SNI) field in encryption, making it invisible to intermediaries. Google's Jigsaw research team worked with Android to implement this feature, and they also announced ECH GREASE, which sends randomized fake ECH values on every connection to make it harder for observers to distinguish protected traffic from unprotected traffic.

The new update improves the situation for users, but there are still significant limits to ECH. It does not hide IP addresses, and network operators can still map IP addresses to services and build usage patterns.