Summary
- Android 17 will add broad OS-level ECH support to hide website hostnames from ISPs and other network observers during HTTPS connections.
- ECH works with Private DNS to protect domain information during both the DNS lookup and TLS handshake.
- This feature only works with compatible websites and apps, and your ISP can still see metadata such as connection timing, traffic volume, and destination IP addresses.
Android 17 is about to make it considerably harder for your internet provider to keep a detailed list of the websites and apps you use. According to Google’s official announcement, the update will introduce broad, operating-system-level support for Encrypted Client Hello (ECH). ECH works in tandem with Private DNS to hide information that would otherwise be exposed before an encrypted HTTPS connection is established.
HTTPS already prevents your ISP from reading the pages you open, your messages, or the sensitive information you enter on websites. That said, your ISP can still determine many of the websites you visit by examining information your phone exposes while looking up and connecting to a website’s server.
Android 17 is closing the privacy gap HTTPS left open
ECH works before the connection begins
When your phone connects to a website, one of the first steps is a TLS handshake, which establishes an encrypted connection between your device and the server. The ClientHello message, which is a common opening message in a TLS handshake, typically includes the site’s hostname in a field called Server Name Indication. This allows a server hosting multiple websites to select the correct certificate. Unfortunately, it can also tell your ISP exactly which website you are visiting.
ECH encrypts the sensitive portion of ClientHello, including the SNI hostname. Network observers can still see that your device is connecting to a destination IP address, but they cannot easily determine which specific website or service it requested.
The new protection works alongside Android’s existing Private DNS feature. You can already enable Private DNS on your Android phone to encrypt the request that translates a domain name into an IP address. However, protecting the DNS request while exposing the same hostname moments later during the connection left a conspicuous hole. Thankfully, Private DNS and ECH can now work together to protect both stages on compatible connections.
What’s worth noting is that Google is implementing ECH at the operating-system level rather than limiting it to one browser. This means compatible Android apps can take advantage of the same built-in protection. With this update, Android 17 becomes the first major mobile OS with broad ECH support.
Google says it is also working with Jigsaw and service providers to accelerate adoption. However, there are some important limitations. ECH only works when the website and the app’s networking stack support it. Google is therefore asking app developers to upgrade to compatible networking libraries and enable the feature.
ECH won’t give you Mr. Robot-level anonymity. Your ISP can still see details such as connection timing and traffic volume. With ECH, your ISP loses one of the clearest signals it can use to identify the specific domain you’re connecting to, although destination IP addresses and other traffic metadata can still reveal or help infer it.