Summary
- Android 17 now supports Encrypted Client Hello, which secures the domain name sent during connection establishment to prevent network visibility.
- This marks the first significant rollout of Encrypted Client Hello on a major mobile operating system, developed by Google’s Jigsaw team along with external developers.
- The feature is only effective for websites and applications that have implemented Encrypted Client Hello; those that haven't will still have their domain names exposed to network operators.
Android users can now enjoy increased privacy while browsing the internet, thanks to the latest update in Android 17.
The new version has activated Encrypted Client Hello, a privacy-enhancing feature that conceals the destination of web requests from the network. This rollout was detailed in a security announcement released on Wednesday.
Myriad: How low will Amazon stock go? Click to make your prediction.When a page loads over HTTPS, its content is encrypted. However, the initial handshake that sets up the connection still reveals the site name in clear text through a field known as Server Name Indication (SNI). This allows any intermediary between a device and a server to see and log the requested site.
Encrypted Client Hello (ECH) changes this by encrypting the site name using a key provided by the destination server, which can decrypt it. As a result, the network sees only a nonsensical identifier instead of the actual domain. This system operates alongside private DNS, which already conceals the process of translating a domain name into an IP address.
It's important to note that ECH only secures traffic to websites and apps that have adopted the feature. Google's announcement specifies "supported websites and apps," and the company is encouraging developers to upgrade to OkHttp 5.5.0 to enable this functionality. Until broader adoption occurs, requests to sites without ECH will still disclose their domain names to the network.
While the network can no longer see the site name, it still detects the IP address of the destination server and the amount of data being transferred. Observers can still infer general activity levels even if the exact site name is obscured. Essentially, the encryption secures the label but doesn't hide the connection itself.
This enhancement in network privacy coincides with ongoing legal challenges regarding Android's device-level privacy features.
Samuel Tunick, an activist from Atlanta, has become the first American charged under federal law for allegedly using a duress password in GrapheneOS, a secure version of Android that wipes the device upon entering the password. GrapheneOS asserts that its software is "completely legal" and constitutionally protected as the case unfolds. A related prosecution has raised questions about data ownership on mobile devices.
“I just hope to send the message that the government doesn’t own our data,” Samuel Tunick expressed in an interview with the New York Times, published on Friday.
Additionally, Android 17 has enabled Certificate Transparency by default and mandates that applications request permission before scanning local networks.