Android 17 to Enable Encrypted Client Hello by Default to Block Metadata Tracking

Google is enabling Encrypted Client Hello (ECH) by default in Android 17 to prevent network observers from tracking which websites users visit. This move addresses a critical vulnerability in how web browsers establish secure connections.

The update targets the Server Name Indication (SNI) field of the TLS handshake. Historically, while HTTPS encrypts the content of a webpage, the SNI field—which contains the hostname of the destination server—typically travels in plain text. By encrypting this metadata, Android 17 ensures the site name in web requests is scrambled, hiding the destination from third parties during the initial connection phase.

The Metadata Gap

For years, the plain-text nature of the SNI field has served as a loophole for metadata surveillance. Even when a user employs a secure connection, Internet Service Providers (ISPs) and government censors can monitor the SNI to see exactly which domains a user is accessing. This visibility facilitates both the tracking of individual browsing habits and the implementation of wide-scale website blocking at the network level.

ECH is an extension of the TLS 1.3 protocol specifically designed to seal this leak. By encrypting the handshake, Google removes one of the last remaining plain-text identifiers that reveal a user's destination to the network infrastructure they are using.

Implications for Privacy

This shift is a significant step in reducing the ability of third parties to conduct network-level surveillance. For users in regions with strict internet censorship or those concerned about ISP data harvesting, ECH makes it substantially harder for observers to build a profile of web activity based on requested hostnames.

However, ECH does not render browsing fully anonymous. Privacy experts note that network observers may still identify a user's destination through DNS queries. Because a device must first resolve a domain name to an IP address, the DNS request itself can leak the website's identity if sent in plain text.

The Path to Full Privacy

To achieve comprehensive domain privacy, ECH must work in tandem with encrypted DNS protocols, such as DNS-over-HTTPS (DoH). Without the combination of both ECH and private DNS, privacy gains are partial, as the DNS query remains a viable point of failure for anonymity.

As Android 17 rolls out, the industry will watch to see if other mobile operating systems and browser vendors accelerate the adoption of ECH. The effectiveness of the feature depends on widespread server-side support, as both the client and the destination server must support ECH for the encryption to function.