Android 17 privacy encryption hides website domains from network snoops
Google is preparing one of the more meaningful privacy shifts to hit Android in years, and it has nothing to do with a new camera feature or design overhaul. Starting with the next major release, Android 17 privacy encryption upgrades will hide the actual website domains people visit from network operators, internet providers and anyone else quietly watching traffic pass by. The change centers on a new standard called Encrypted ClientHello, or ECH, which Google says it is building directly into the operating system to close a surprisingly persistent gap in everyday web security.
Key takeaways
- Google will add Encrypted ClientHello (ECH) support in Android 17 to hide website domain names during the very start of a connection.
- Even on HTTPS sites, domain names are currently visible to network operators and eavesdroppers, allowing detailed user profiling.
- ECH scrambles the site name using a secret key that only the destination website can unlock.
- A companion feature called ECH GREASE, developed by Jigsaw, will be turned on by default in Android 17 to mask connection metadata even on sites that don’t yet support ECH.
- Full protection depends on websites and apps adopting the ECH standard, something Google says it is actively pushing with industry partners.
Android 17 Introduces Encrypted ClientHello for Enhanced Privacy
Encrypted ClientHello is designed to stop the very first handshake of a web connection from leaking which site someone is about to visit. Google confirmed the feature in an August 27 blog post, framing it as a direct response to how much metadata modern browsing still exposes, even when everything looks secure on the surface.
… Continue reading the full article at the original source below.
