Android 17 Adds OS-Wide ECH to Hide Website Visits From Network Providers Android 17 添加全系统 ECH 以隐藏网站访问记录

TL;DR

• Android 17 introduces OS-wide Encrypted Client Hello (ECH) support, encrypting destination domain names at the TLS handshake to prevent network providers from eavesdropping on browsing activity
• ECH GREASE is enabled by default, sending randomized fake ECH extensions to non-supporting servers to ensure all connections appear uniformly protected and resist fingerprinting
• OkHttp has integrated ECH into its core library, enabling third-party Android app developers to adopt the privacy standard without building custom implementations
• Google enforces Local Network Protection requiring explicit user permission before apps can scan or connect to devices on the local network
• Certificate Transparency is enabled by default, and telecom operators can disable 2G by default as a zero-click defense against downgrade attacks and SMS blaster threats

Why It Matters

This represents a significant shift from browser-level to OS-level privacy enforcement, meaning all network traffic on Android 17 devices benefits from ECH protection regardless of the application or browser used. For AI and security practitioners, it signals the industry's growing recognition that metadata leakage—particularly domain-level visibility—poses as significant a privacy risk as content interception, and sets a precedent for other mobile operating systems to follow.

Technical Details

• ECH (Encrypted Client Hello): Encrypts the SNI (Server Name Indication) field in TLS 1.3 handshakes using a secret key only the destination server can decrypt, working in tandem with private DNS to obscure visited domains from network-level observers
• ECH GREASE: Randomized fake ECH extensions are sent to servers that do not support ECH, preventing traffic analysis that could distinguish ECH-protected connections from unprotected ones—a critical defense against selective surveillance
• OkHttp Integration: Jigsaw's open-source HTTP/HTTP.2 client library now includes native ECH support, lowering the barrier for third-party developers to adopt the standard without implementing it from scratch
• Local Network Protection: A new permission model requiring apps to request explicit user consent before performing local network discovery or establishing connections to other devices on the same LAN
• Certificate Transparency (CT) Default: All websites are now required to be logged in public CT logs by default, strengthening certificate pinning and reducing the risk of malicious certificate issuance
• 2G Disablement for Carriers: A zero-click mechanism allowing telecom operators to disable legacy 2G connectivity by default, mitigating IMSI catchers, Stuxnet-style downgrade attacks, and SMS blaster infrastructure

Industry Insight

• Android's move to OS-wide ECH pressures other platforms (iOS, Windows, Linux distros) to adopt similar standards, potentially accelerating industry-wide encryption of TLS metadata and raising the baseline for consumer privacy expectations
• The OkHttp integration demonstrates a growing trend of security features being pushed through open-source infrastructure libraries rather than requiring per-app development, a model that could be replicated for future privacy protocols
• The 2G disablement feature highlights the ongoing relevance of legacy protocol vulnerabilities in mobile security; AI-powered SMS blaster campaigns and rogue base station attacks remain active threats, and carriers should treat this zero-click mitigation as essential infrastructure hardening

TL;DR

• Android 17新增OS级ECH（Encrypted Client Hello）支持，加密客户端Hello消息中的目标网站域名，防止网络提供商窥探用户访问记录
• ECH GREASE将默认启用，通过发送伪造的随机ECH扩展，使所有连接请求看起来相同，避免仅部分连接受保护
• OkHttp开源HTTP客户端已集成ECH支持，第三方Android应用开发者可直接利用该能力
• 新增Local Network Protection，要求应用扫描或连接本地网络设备前必须获得用户权限
• 默认启用Certificate Transparency（证书透明度）并允许运营商默认关闭2G网络，防范降级攻击和SMS blaster威胁

为什么值得看

Android 17将ECH从浏览器层面提升至操作系统层面，标志着移动端隐私保护从应用级向系统级的演进，对构建端到端加密通信生态具有里程碑意义。这一变化将推动更多Android应用和网站采用ECH标准，同时为运营商和开发者提供新的安全实践参考。

技术解析

ECH（Encrypted Client Hello）通过加密TLS握手阶段的客户端Hello消息，隐藏目标域名信息，仅目标网站可使用密钥解密。该技术与Private DNS协同工作，从连接起始阶段即保护元数据，防止网络侧画像分析。

ECH GREASE机制通过向不支持ECH的服务器发送伪造的随机扩展，确保所有连接请求外观一致，避免仅部分流量受保护而暴露隐私。Android 17默认启用此机制，降低部署复杂度。

OkHttp作为Android生态主流HTTP客户端，已将ECH集成至核心库，为第三方开发者提供开箱即用的隐私保护能力。这一集成加速了ECH在Android应用层的普及。

Local Network Protection强制应用请求用户授权后方可扫描或连接本地网络设备，防止恶意应用探测家庭网络拓扑。Certificate Transparency默认启用要求所有网站证书公开可查，增强证书颁发透明度。

2G网络关闭功能为运营商提供零点击解决方案，自动禁用老旧2G协议，防范IMSI捕获器、SMS blaster等基于2G的降级攻击，弥补Android 12手动关闭和Android 14管理员策略的局限。

行业启示

移动端隐私保护正从应用层向系统层下沉，操作系统厂商通过内置安全机制降低开发者集成成本，这一趋势将推动ECH等隐私标准成为移动生态的基础设施。

运营商网络侧将面临更严格的隐私合规要求，2G退网和ECH部署将重塑移动网络的安全架构，运营商需同步升级基础设施以适配新的隐私保护标准。

Android生态的隐私增强功能通过OkHttp等中间件快速扩散至第三方应用，这种"系统级能力+开源组件"的推广模式可为其他平台提供借鉴，加速安全标准的行业落地。