Android 17 Adds ECH and 2G Kill Switch to Block Snoops, Fake Towers

Q: While Android 17 hides your browsing with ECH, could your unique IP address still betray your digital footprint to ISPs?

Yes. Android 17’s ECH closes a major privacy leak by encrypting the website name in the TLS handshake, but it does not hide the destination IP address, connection timing, or traffic volume from an ISP. That means an ISP can still see which server your phone connects to. In some cases, that may be enough to make a strong guess about what you are doing, especially if a service uses a dedicated IP address. ECH is strongest when the destination sits behind shared infrastructure such as a CDN or large hosting platform, where many sites share the same IP and the address alone does not point to one specific site. ECH also depends on support from both the app and the server. If either side does not support it, Android falls back to normal TLS, though ECH GREASE can make protected connections harder to distinguish. Google recommends developers use ECH-capable libraries such as OkHttp 5.5.0 and fetch ECH settings from DNS HTTPS records before the handshake. For fuller protection, ECH needs to work alongside encrypted DNS. These solve different problems: encrypted DNS hides the domain lookup, while ECH hides the hostname in the handshake. Even with both in place, ISPs can still observe metadata such as IP addresses, session length, and data volumes, which can still reveal patterns. So Android 17 makes ISP profiling materially harder, but not impossible. It reduces visibility into exactly which site or app endpoint you are reaching; it does not deliver anonymity.

3 articles · Updated · ZDNet · Aug 31

Google said Android 17 is the first mobile OS to support Encrypted Client Hello, which encrypts the website name in the TLS handshake instead of exposing it through SNI.
ECH only works when apps use compatible networking libraries and servers or CDNs publish ECH keys in DNS HTTPS records; otherwise connections fall back to standard TLS, and DNS and IP metadata can still leak.
Android 17 also lets participating carriers disable 2G by default, closing a downgrade path that fake base stations and SMS blasters use to push phishing texts after forcing phones off LTE or 5G.
That protection carries a roaming trade-off: phones may lose service in places where 2G is still part of the network mix until users manually re-enable it.
The release also turns on local-network permission controls and Certificate Transparency by default, though the full benefit depends on app developers, carriers and network operators adopting the new features.