Android 17 blocks network snoops with ECH and turns off 2G by default

ECH closes a long-standing metadata gap in HTTPS. While HTTPS encrypts the contents of a web session, the hostname of the site being visited has remained visible in the Server Name Indication field of the TLS ClientHello handshake. That allowed ISPs, Wi-Fi operators, corporate networks, and unauthorized snoopers to identify sites and services a user was visiting. In Android 17, the SNI is encrypted from the start of the handshake. The release also enables Certificate Transparency by default and enforces new local-network permissions.

Google said that, for supported websites and apps, network providers and network snoopers can no longer easily see which sites or apps are being accessed, especially when ECH is used alongside Android's Private DNS feature. The protection requires more than just the operating system: Android's developer documentation says ECH is enabled by default on Android 17, API level 37 and later, but an application needs an ECH-capable networking library. Google advised developers to upgrade to OkHttp 5.5.0 and enable ECH. When a destination server does not support ECH, Android can use ECH GREASE, a mechanism that makes protected connections harder to spot while permitting a conventional TLS connection when needed.

ECH is not a VPN and does not erase all traffic metadata. Network observers may still see a device's destination IP address, connection timing, traffic volume, and the broad hosting or content-delivery network involved. It also does not hide DNS requests, so its privacy value depends heavily on pairing it with encrypted DNS such as Private DNS. For ECH to work, the destination server, reverse proxy, or CDN must publish an ECH public key that is discoverable through DNS HTTPS records; if any part is missing, the phone or browser falls back to a conventional TLS handshake and the SNI becomes visible again.

Android 17 also extends an anti-fraud feature first available in Android 12: disabling 2G at the radio-hardware level. In the new release, participating carriers can turn off 2G by default for subscribers, so users do not need to find and enable the setting themselves. This is designed to block attacks using SMS blasters, or false cellular base stations, which broadcast a strong signal to force nearby phones to abandon LTE or 5G and connect through older 2G technology. Once a handset is on 2G, attackers can bypass newer network-side anti-spam measures and deliver phishing texts directly to it.

Android's Open Source Project documentation warns that a phone may continue scanning for and connecting to 2G base stations even when its carrier has retired 2G service, leaving it susceptible to downgrade attacks. Disabling 2G prevents the device from scanning or connecting to those networks. There is a practical trade-off: turning off 2G can affect coverage while roaming in places where 2G remains part of the available network mix. Though the three major U.S. carriers no longer support 2G, many carriers in the UK and India, as well as in much of Europe and the Global South, still do.