The Android 17 update will close the last remaining loophole that allows internet service providers and other intermediaries to track which websites users visit.
Google has announced that Android 17 will support Encrypted Client Hello (ECH). This will help close a significant privacy gap that allows internet service providers, Wi-Fi hotspot operators, and other network observers to see which websites users visit.
It was previously reported that even when encrypted DNS and modern TLS are used, visited websites can still be identified through the TLS ClientHello message, which contains an unencrypted Server Name Indication (SNI) field. Any intermediary on the network can intercept this data. Cybersecurity instructor David Bombal demonstrated this live using network traffic interception tools and Wireshark.
Google acknowledges that unencrypted ClientHello messages represent a critical privacy gap.
“This unencrypted data can be used to build user profiles or, if it falls into the hands of malicious actors, to conduct targeted phishing and scam campaigns,” the technology giant said in a statement.
The new ECH standard works alongside private DNS and hides the remaining metadata. It encrypts the destination website name for supported websites and applications.
According to Jigsaw, Google’s technology incubator and research unit, which worked with the Android team to address data leakage through ClientHello, the implementation is based on a new internet standard published earlier this year.
Most web servers still do not support ECH, so the domain name remains visible in such cases.
“Achieving long-term internet privacy requires coordinated efforts across operating systems, networking libraries, and applications. Ecosystem leaders have expressed strong support for bringing ECH into the mainstream,” Jigsaw said in a Medium post.
Android will use a feature called ECH GREASE, which stands for Generate Random Extensions And Sustain Extensibility. When a server does not support ECH, the system will send several randomly generated fake ECH values, making all connection requests look the same.
GREASE makes it harder for network observers to determine which connections are protected by ECH and which expose a visible domain name. The feature also does not affect connection stability. Jigsaw tested GREASE on 10,000 domains and recorded no changes in connection success rates.
Google is urging Android application developers to upgrade to OkHttp 5.5.0, the latest version of the popular open-source HTTP and HTTP/2 client, and enable ECH by default.
However, users must still ensure that they are using encrypted DNS. If a device relies on a DNS server provided by an internet service provider or Wi-Fi network, the user’s entire website browsing history may remain visible.
DNS and TLS encryption protect data while it is being transmitted, but they do not make a connection completely invisible to third parties. Network operators or malicious actors intercepting the traffic can still see the IP addresses involved.
Decrypted traffic may be accessible to the website operator and infrastructure providers, including hosting companies and reverse proxy operators such as Cloudflare. Using a VPN or the Tor network can hide the user’s real IP address.
