Android 17 hides the sites you visit, but not in every app

Google published a post on Thursday about four network protections in Android 17. None of them is new. All four shipped with Android 17 back in June, and this is the first time Google explains them to ordinary users. The update is only now reaching phones in numbers, and Motorola has confirmed more than 50 models for it. Read Google's own developer documentation, though, and the protections turn out not to apply to everyone.

What stays visible even over HTTPS

HTTPS encrypts the contents of a connection. The name of the destination still travels in the clear during the handshake, in a field called Server Name Indication. Anyone watching the traffic can build a profile from it or craft a convincing scam message. Encrypted Client Hello, or ECH, encrypts that field. All an observer keeps is the IP address. On a large provider with hundreds of sites behind one address, that gives away very little. On a small server with an address of its own, it still does.

ECH only applies to newly built apps

Google's blog post makes the matter sound settled. The developer documentation is more precise. It states that ECH is switched on for apps targeting Android 17 and API level 37. An app still built for Android 16 gets no encryption at all on an Android 17 phone.

The app also needs a networking library that speaks ECH. OkHttp 5.5.0 ships with support, though as an option developers have to enable. Google's own ECH page for developers meanwhile still says support in OkHttp is yet to arrive. A VPN is no reliable substitute either, as our look at free VPN apps for Android showed.

Encrypted DNS or nothing

ECH hides the hostname inside the TLS handshake. The same address still sits in the DNS lookup your phone uses to find the matching IP. Should that lookup run unencrypted, your provider reads it there and the benefit is gone. On Pixel phones the switch lives under Settings, Network and internet, Private DNS. On Samsung phones it sits under Connections, More connection settings, Private DNS. The other end has to support ECH as well. Google does not say how many sites already do, only that it is working with the industry to speed adoption up.

Home network and certificates, same catch

Until now any app could quietly scan your Wi-Fi for devices, from the television to the security camera. Android 17 requires a new permission for that. According to the documentation it again covers only apps targeting Android 17, so older ones keep scanning. Certificate Transparency, which makes forged certificates stand out, follows the same pattern. Your own network deserves a look in any case, because routers remain a regular target.

The 2G trick, and who gets to stop it

The fourth item targets SMS blasters. These are portable cell sites that force nearby phones off LTE or 5G and onto the old 2G network, where spam filters no longer apply and the fraudulent message lands straight on the display. Google puts the cost of the hardware at around 3,000 US dollars. In Toronto the devices were driven around the city in vehicles, in London offenders carried them through Tube stations in suitcases. A switch against 2G has existed since Android 12. What is new is that carriers can now turn 2G off for their customers themselves. Google names not a single carrier that does. Either way, the choice is not yours.