Android 17 Adds OS-Wide ECH to Hide Website Visits From Network Providers
Summary: Google announced on Thursday that Android 17 will support Encrypted Client Hello (ECH) at the operating system level, encrypting the destination website name so network providers and snoopers cannot easily see which sites or apps a user accesses. ECH GREASE, which sends fake randomized ECH extensions to sites that don't support ECH, will be enabled by default, and Google also enforced Local Network Protection, enabled Certificate Transparency by default, and let telecom operators turn off 2G by default for subscribers.
Key Takeaway: The 2G default-off option is zero-click for participating carriers, removing a primary method used by SMS blasters and rogue base stations before they can target a device - a legacy attack surface that until now required users or IT admins to disable manually.
Read the original at The Hacker News ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026