Google is adding a set of network-security protections to Android 17, led by platform-level support for Encrypted Client Hello, according to BleepingComputer. The change is meant to reduce how much browsing and app-connection metadata can be observed by internet service providers, Wi-Fi operators, and other network watchers. ECH is a privacy extension for Transport Layer Security, the protocol used to secure HTTPS connections. BleepingComputer reports that it encrypts the early part of the TLS handshake that can otherwise reveal the destination hostname through Server Name Indication. In practice, even when the content of a web session is encrypted, the destination domain can still be visible to the network; ECH is designed to hide that metadata for supported services. According to the report, Android 17 pairs ECH with private DNS so domain names are harder to use for profiling. Google’s announcement, as cited by BleepingComputer, says the standard is intended to obscure visited domains and make it harder for network providers or snoopers to see which supported websites or apps a user is accessing. The distinction is that ECH has already been available to Android users in supported browsers — BleepingComputer cites Chrome 117 and later and Firefox 119 and later — but Android 17 moves support into the platform. That matters for apps, not just browsers. BleepingComputer reports that ECH will be enabled by default for apps targeting Android 17 if they use a compatible networking library, including recent versions of OkHttp, WebView, or HttpEngine. The protection still depends on server support. For servers that support ECH, Android 17 will encrypt the hostname, according to the report. For servers that do not, Android will send an ECH GREASE field that resembles ECH traffic so genuine ECH use is less conspicuous, although BleepingComputer notes the hostname remains visible in that fallback case. Google’s Jigsaw unit tested ECH GREASE against the top 10,000 domains and across 740 internet providers in 202 countries, BleepingComputer reports. The test found no site-loading issues or unexpected network blocks, according to the report. Android 17’s networking changes go beyond ECH. BleepingComputer says Google also announced updates to Local Network Protection that require apps to obtain permission before scanning for or connecting to devices on a user’s local network. Android 17 also enables Certificate Transparency by default, requiring website certificates to appear in public logs so forged certificates are easier to detect. Google is also giving participating mobile operators the ability to automatically turn off 2G for subscribers, according to the report. The goal is to reduce exposure to SMS blasters and rogue base stations that can deliver malicious messages or capture sensitive traffic from nearby devices. Who benefits: Android users benefit where apps and servers support ECH, and developers using compatible networking libraries may get stronger connection privacy with less custom work. Enterprises and privacy-sensitive organizations also gain from default Certificate Transparency and tighter local-network access controls. Who's exposed: Network providers, Wi-Fi operators, and other intermediaries lose some visibility into supported users’ destination metadata. Apps that scan or connect to local-network devices may face additional permission requirements in Android 17.