Encrypted Client Hello (ECH) on Android 17
Android 17 turns on Encrypted Client Hello (ECH) to hide the destination of a web request from the network. Google is encouraging developers to upgrade to OkHttp 5.5.0 and enable ECH; ECH currently protects only destinations that have adopted it, and until adoption spreads requests to sites without ECH still reveal the domain to the network; the network still sees destination IP addresses and traffic volume, and ECH runs on top of private DNS.
Encrypted Client Hello (ECH) encrypts the Server Name Indication (SNI) field so that only the destination server can unwrap the original site name, while other network nodes see a meaningless label. Android 17 turns on ECH to hide the destination of a web request from the network. ECH runs on top of private DNS infrastructure. The encryption therefore targets the site name carried in SNI rather than other observable connection metadata.
ECH protects traffic only for destinations that have adopted it, and Google is encouraging developers to upgrade to OkHttp 5.5.0 and enable ECH. Until adoption spreads, requests to sites without ECH still reveal the domain to the network. The network continues to see the destination server’s IP address and the volume of data transferred. Encryption hides the site name but does not conceal that a connection occurred in practice.
Android 17 enables Certificate Transparency by default and requires apps to ask permission before scanning a local network. Certificate Transparency is enabled by default in Android 17. The operating system also requires that apps request permission before scanning a local network. These settings are implemented in Android 17 as additional security-related configurations mentioned in the release information.
These points were reported alongside other Android 17 security changes and related developments. The legal matter involving GrapheneOS and Samuel Tunick is proceeding as described above.
