Android 17 flips on a new privacy switch — but it’s not a magic cloak for your web activity. What changed - Google has enabled Encrypted Client Hello (ECH) by default in Android 17. ECH encrypts the Server Name Indication (SNI), the part of the TLS handshake that traditionally tells every network hop which domain your device is connecting to. With ECH, the site name in the ClientHello is encrypted to a key published by the destination server, so intermediate nodes only see a meaningless label instead of the real domain. - ECH works together with private DNS (DoH/DoT) to hide both the DNS lookup and the SNI, closing two common ways observers learn what sites a device visits. Why this matters to crypto users - For privacy-conscious crypto users — custodial or self-custodial wallet operators, traders, or anyone interacting with web wallets and exchanges — hiding site names reduces easy surveillance of which platforms you visit. That can lower the risk of simple network-level profiling tied to crypto activity. - However, ECH is only effective when the destination supports it. If a site hasn’t adopted ECH, the domain will still be visible in cleartext during the handshake. Important limits to know - ECH does not hide everything. The network still sees the destination IP address and the size and timing of traffic. Observers can often infer activity at a coarse level (e.g., connections to a particular exchange’s IP range) even when the domain is hidden. - In short: ECH locks the label (the domain name in the handshake) but not the fact that a connection occurred or how much data moved. Rollout and developer notes - Google’s security post asks developers to upgrade to OkHttp 5.5.0 and enable ECH-supporting code paths. Server- and app-side adoption is the bottleneck: until more sites and apps enable ECH, many connections will still reveal domains on the wire. Other Android 17 privacy moves - Certificate Transparency is now on by default, making it easier to detect misissued TLS certificates. - Apps must request permission before scanning a device’s local network — a useful check for preventing stealth device discovery. Context: privacy vs. law enforcement - Google’s timing comes as device-level privacy protections face legal scrutiny. Samuel Tunick, an Atlanta activist, became the first known American charged under federal law for allegedly using a duress password feature in GrapheneOS (a hardened Android build) that wipes a device when triggered. GrapheneOS says its software is legal and constitutionally protected as the case proceeds. Tunick told the New York Times, “I just hope to send the message that the government doesn’t own our data.” - The case underscores that technical privacy gains can collide with legal and investigative pressures — and that controlling data on a phone remains a contested issue. Takeaways - If you care about network privacy, update to Android 17 and encourage the services you use to adopt ECH and modern TLS stacks. - Developers — especially those building crypto apps, wallet interfaces, or exchange clients — should prioritize OkHttp 5.5.0 (or equivalent libraries) and server-side ECH support to give users the intended protections. - Remember that ECH is a meaningful step forward, but not a full solution: IP addresses, traffic patterns, and other metadata still reveal a lot. Keep layering protections (VPNs, Tor where appropriate, good operational security) if your threat model requires stronger anonymity. Read more AI-generated news on: undefined/news