Android 17 to close critical privacy gap that makes web browsing history visible to ISPs
Even with TLS and DNS encryption, your browsing history remains exposed.
Image by SOPA Images | Getty Images
- Android 17 will support ECH to hide visited website names from ISPs and network observers.
- ECH works only with supported websites and apps, so many domain names may still remain visible.
- Google says randomized fake ECH values make unsupported connections harder to identify without hurting connection success.
- Users still need VPNs or Tor to hide their real IP address.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
An Android 17 update will eliminate the final loophole that allows ISPs and other intermediaries to track which websites users visit.
Google announced that Android 17 will support Encrypted Client Hello (ECH), closing a major privacy gap that exposes users' web browsing habits to internet service providers (ISPs), WiFi hotspot operators, and other network observers.
Cybernews has previously reported that even when using encrypted DNS and modern TLS, the visited websites are still visible in the TLS Client Hello message, which contains an unencrypted Server Name Indication (SNI) field. Any intermediary in the network can capture this data – Cybersecurity instructor, David Bombal, demonstrated it live using a network tap and Wireshark.
Google acknowledges that unencrypted Client hello messages are a critical privacy gap.
“This unencrypted data can be used to build user profiles or, in the hands of malicious actors, leveraged for targeted phishing and scam campaigns,” the tech giant said in an announcement.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
The new ECH standard works in tandem with private DNS and hides the remaining metadata. It encrypts the destination website name “for supported website and apps.”
According to Jigsaw, a technology incubator and research unit within Google, which teamed up with Android to address the leaking ClientHello, the implementation relies on a new internet standard published earlier this year.
Most web servers still don’t support ECH, and in these cases, the domain name remains visible.
“Achieving lasting internet privacy requires alignment across operating systems, networking libraries, and applications. Leaders across the ecosystem have voiced strong support for bringing ECH into the mainstream,” said Jigsaw in its post on Medium.
Android will use a feature called ECH GREASE (Generate Random Extensions And Sustain Extensibility) to send multiple randomized fake ECH values when the server doesn’t support ECH, making every connection request look the same.
GREASE makes it harder for network observers to identify which connections are ECH-protected and which are not, containing the domain name. It also doesn’t affect connectivity – Jigsaw tested GREASE on 10,000 domains and measured zero change in connection success rates.
Google urges Android app developers to upgrade to OkHttp 5.5.0, an updated version of the popular open-source HTTP and HTTP/2 client, and enable ECH by default.
However, users still need to make sure they’re using encrypted DNS – relying on the ISP or WiFi-provided DNS resolver might still mean that all web history remains visible.
Check if your data has been leaked
DNS and TLS encryption protect data in transit, but they don’t make a connection completely invisible to third parties. Network operators or attackers in the middle can still see the IP addresses involved.
Decrypted traffic can be accessed by the website operator and by infrastructure providers such as hosting companies or reverse proxies like Cloudflare. Using VPNs or the Tor network hides the user’s real IP address.