Follow ZDNET: Add us as a preferred source on Google.
ZDNET’s key takeaways
- ECH will help hide which websites you visit on your Android phone.
- By blocking 2G connections, you’re protected from malicious SMS-blaster connections.
- ECH is still being rolled out, so even if your phone supports it, your connection may still be unsafe.
According to Google, Android 17 offers a few new ways of keeping your connections secure and private. On Thursday, the company announced that Android 17 is the first mobile operating system to support Encrypted Client Hello (ECH), a TLS privacy feature that hides destination domain names. The release also enforces new local-network permissions and enables Certificate Transparency by default. The new Android version also enables telecoms to block their phones from often malicious 2G access points.
But what is ECH, and how do these protections secure your browsing? Let’s break it down.
ECH closes an HTTPS metadata gap
HTTPS has long encrypted the contents of web sessions, but it doesn’t hide the website hostname you’re visiting. That information was exposed in the Server Name Indication (SNI) field of the TLS ClientHello handshake. This gave ISPs, Wi-Fi operators, corporate networks, and unauthorized snoopers a way to identify sites and services you were visiting, even when they couldn’t read the connection’s content.
Adding ECH support in Android 17 encrypts SNI in the opening TLS handshake.
“By encrypting the destination website name from the very start, ECH helps ensure that, for supported websites and apps, network providers and network snoopers can no longer easily see which websites or apps you are accessing,” Google explained, especially used alongside Android’s Private DNS feature.
Also: How to turn on Private DNS Mode on Android – and why it’s a must for security
The qualification — “for supported websites and apps” — matters. Android’s developer documentation says ECH is supported by default on Android 17, API level 37, and later, but an application needs an ECH-capable networking library. Developers can configure the protection through Android’s Network Security Config, while network libraries must retrieve ECH configuration data from DNS HTTPS records and set it before beginning the TLS handshake.
Google specifically advised developers to upgrade to OkHttp 5.5.0 and enable ECH. When a destination server does not support ECH, Android’s documented approach includes ECH GREASE. This mechanism makes protected connections harder to spot while permitting a conventional TLS connection when necessary.
That said, ECH is not a VPN, and it does not erase all traffic metadata. Network observers may still see a device’s destination IP address, timing, traffic volume, and the broad hosting or content-delivery network involved. ECH also does not hide DNS requests, which is why its privacy value depends heavily on pairing it with encrypted DNS, such as Private DNS.
Oh, and for those of you on the desktop, most web browsers have long supported ECH.
For ECH to really work, however, it needs to be supported on both sides of a network connection. Specifically, ECH only works if the origin, reverse proxy, or Content Delivery Network (CDN) has provisioned an ECH public key and makes its configuration discoverable through DNS HTTPS records. If any link is missing, your phone or browser will fall back to a conventional TLS handshake. That means the SNI will be visible again.
Carriers get a 2G kill switch
Android 17 also extends an anti-fraud defense first made available to users in Android 12: disabling 2G at the radio-hardware level. The new release lets participating mobile carriers turn off 2G by default for subscribers. With this, you no longer need to find and enable the setting yourself.
Also: How to enable Advanced Protection on Android 16 – and why you shouldn’t skip it
You might ask, “Why would I bother? Who uses 2G networking? Or, for that matter, 3G?” Well, you see, while none of the three major phone companies in the United States still support 2G, that’s not the case outside our borders. Most carriers in the UK and India, for example, still support it, as do many countries in the Global South and much of Europe.
So why block it? Because in many ways, hackers and crooks use SMS blasters, or false cellular base stations. Such devices can broadcast a strong signal that persuades nearby phones to abandon LTE or 5G and connect through older 2G technology. Once a handset has been forced onto 2G, attackers can bypass newer network-side anti-spam measures and deliver phishing texts directly to targets.
The security rationale goes beyond whether a legitimate carrier still operates a 2G network. Android’s Open Source Project documentation warns that a phone may continue scanning for and connecting to 2G base stations even when its carrier has retired 2G service. This leaves them susceptible to downgrade attacks via SMS blasters. Disabling 2G prevents the device from scanning or connecting to those networks.
Security gain, roaming trade-off
There is a practical caveat. Turning off 2G can affect coverage while roaming in places where 2G remains part of the available network mix. You may not run into it, but if you’re like me and do a lot of international travel, including venturing away from major cities, this can stop you from getting a legitimate connection just when you need it the most.
Also: I enabled Android’s security feature that detects fake cell towers – here’s why
Android’s documentation says a security-driven 2G disablement will remain in effect while roaming, potentially leaving a user without service until they manually re-enable the older network type. Google says it cannot reliably detect 2G roaming because 2G lacks mutual authentication. That’s exactly the design weakness that makes fake-base-station attacks viable.
That trade-off is likely to limit the feature’s universal use, particularly for people like me. But for participating carriers, the default-off policy removes a legacy attack surface before a subscriber encounters an SMS blaster.
Broader network hardening
The ECH and 2G changes are part of a larger Android 17 network-security package. Local Network Protection is now enforced. This requires appForion before, which means it can’t connect to other devices on a user’s local network. Android 17 also enables Certificate Transparency by default. This standard forces website certificates to be logged, which makes it easier to spot fraudulent or improperly issued certificates.
Also: This silent Android feature scans your photos for ‘sensitive content’ – how to uninstall it
For you and me, this means your Android connection will be more secure, and you won’t have to do anything to get these benefits. However, until the developers and telecoms fully support these changes in programs, services, and networks, there’s no guarantee that you’ll get the benefits. Hang in there; within the next year, all these new security features will be fully implemented.
