Android 17 adds new protections against sneaky Wi-Fi tracking and web snooping

Google introduced a batch of network security changes coming in Android 17, aimed at making it harder for network operators, snoops, and scammers to track what you do on your phone.

“When you visit a website or use an app, even if the connection is encrypted by HTTPS, the domain names of the sites you visit are still visible to network operators and eavesdroppers. This unencrypted data can be used to build user profiles or, in the hands of malicious actors, leveraged for targeted phishing and scam campaigns,” Google software engineer Bram Bonné and product manager Shuaibo Huang explained.

Android 17 closes that gap with support for Encrypted Client Hello (ECH), a privacy standard that works together with private DNS to keep the destination hidden from outside observers.

Encrypted Client Hello (ECH) diagram (Source: Google)

ECH encrypts the domain name with a key only the destination server can unlock. Because support for ECH among web servers is still uneven, apps and browsers also need to send GREASE, a decoy version of the encrypted extension, so an outside observer can’t tell which connections are protected just by looking at their shape.

Google says Android is the first major mobile operating system to roll out broad ECH support, and it’s working with Jigsaw (Google’s internet safety unit) and app developers to speed up adoption.

“ECH support for Android is a huge step towards closing one of the largest remaining structural privacy holes left on the Internet,” said Nick Sullivan, Co-author of the ECH standard and Founder of Cryptography Consulting LLC.

For apps targeting Android 17, ECH turns on by default, as long as the app runs on a networking library that supports it, such as newer versions of OkHttp, WebView, or HttpEngine.

Rolling a change like this out to billions of devices means testing it first. Jigsaw ran two checks. In the first, GREASE requests went out to the top 10,000 domains worldwide, and connection success held steady compared to ordinary TLS.

In the second, the team ran requests through 202 countries and 740 ISPs, including heavily filtered networks like Russia and China, and found interference stayed near zero everywhere.

“Internet security must evolve continuously to match modern threats. Jigsaw’s ECH measurements helped validate deployment in Android 17, addressing a long-standing vulnerability and advancing our shared goal of a more private web,” noted David Kleidermacher, VP of Engineering, Android Security & Privacy.

Android 17’s new security features target tracking, fake certificates and SMS blasters

Beyond ECH, Google rolled out three more changes that work toward the same goal.

Local Network Protection makes apps ask before they can scan or connect to other devices on your home network, closing off a way apps used to profile your household through your smart TV, cameras, and consoles.

Certificate Transparency is on by default, forcing certificates into a public log so forged ones are harder to slip through unnoticed.

And participating mobile operators can now switch off 2G for their subscribers with no action needed on the user’s end, cutting down exposure to SMS blasters, the fake base stations that force phones onto old, insecure networks to push phishing texts past spam filters.

“Your privacy and security should never be a compromise as technology evolves. These new Android 17 protections work seamlessly behind the scenes so you can connect, browse, and communicate with peace of mind,” Google concluded.