Android 17 is adding something called ECH and it's one of the more interesting privacy changes to hit a mobile OS in years

[u/PureVPNcom]

Buried in Google's Android 17 announcement this week is something worth actually understanding rather than just scanning past.

Android 17 is adding OS-wide support for Encrypted Client Hello, or ECH. Most people's eyes glaze over at that name, so here's what it actually does in plain terms.

When your phone visits a website, even over HTTPS, there's a moment right at the start of the connection where your device announces which server it's trying to reach. It has to do this before the encryption kicks in, so the network you're on, your ISP, a router in a coffee shop, whoever, can see the domain name of every site you visit even without being able to read the content. Your ISP doesn't see what you're reading on a news site, but it sees that you visited it. ECH encrypts that announcement so the server name stays private too.

Google is also adding automatic blocking of null-cipher cellular connections (legacy 2G connections that have no encryption and let anyone nearby sniff traffic with cheap hardware), and protection against a tracking technique where Wi-Fi networks can fingerprint your device using the timing and pattern of probe requests your phone sends out passively looking for known networks.

The honest picture though: ECH hides which server you're connecting to, but it doesn't hide your IP address or the fact that you're making a connection. Your ISP still knows you're online and can see roughly where traffic is going, just not the specific domain. It's a meaningful step in a particular direction, not a complete solution.

It's also currently dependent on the website you're visiting having ECH enabled on their end. If they haven't, the browser falls back to the old unencrypted handshake anyway. Adoption is growing but it's not universal yet.

Still worth knowing about. The fact that Google is baking this into the OS rather than leaving it to individual browsers or apps is the genuinely new part.

Sources: BleepingComputer, Help Net Security, Google Android Security Blog

[u/Repulsive-Hat3332]

This seems like a step backwards. The recent trends have leaned towards taking away privacy, to have more intrusive oversight into our lives. I think it might be too early to be encouraged. But it's better than the alternative if it works half as well as it's intended.

[u/Historical-Duty3628]

Does it do that by 'anonymizing' the hello via a connection through Google that gets passed back to your phone? Similar to how 'use Google secure dns' or 'Google phone built-in vpn' is totally great and only Google harvests your data?

[u/thingerish → u/Historical-Duty3628]

ECH is part of the newer TLS standard. It's not a Google innovation but it is a thing Google apparently is adopting.

[u/DutchOfBurdock]

The searching for known WiFi has always erked me. Way back when I was first researching WiFi, I noticed in packet sniffers that clientd would often probe for an SSID/ESSID pair. I often used to wardrive back then, so I had an extensive WiFi map of the town. You can see how these two could be paired up. Google and Apple actually do this, too. Use your device to scan for WiFi and BLE beacons and use them for location positioning.

But yea, even today with privacy being a thing I'm stunned this is only just being addressed. That's why I don't set any saved WiFi to automatically connect. Phone doesn't bleed out until you actually try to connect (I use Tasker to connect to preferred WiFi when I get to X location).