From Browsers to Apps: Android 17 Expands ECH Protection

Mobile phone security and privacy are important because of their widespread use. According to datareportal.com, 6.12 billion people, or 73.8% of the world's population, use a mobile device. Beyond widespread use, time spent on mobile phones is also very high. On average, each mobile phone user is glued to their device for 33 hours and 13 minutes each week, according to the same report. A monitored or hacked mobile device will reveal not just a person’s personal interests but also their important financial details.

Fortunately for Android users, their privacy and security just got upgraded with the upcoming Android 17.

Introducing OC-Level ECH Support

Android 17 will introduce an expanded ECH (Encrypted Client Hello) for all its users. According to their announcement blog, “This new privacy standard works in tandem with private DNS to obscure the domain names you visit, hiding metadata that can be used to profile you.” It’s good news for Android users but a challenge for ISPs and third-party companies that build user profiles based on online activity.

ECH is already enforced on Android but is limited to Google’s Chrome browser and Firefox. The difference with Android 17 is that the implementation is OS level. Android 17 users can enjoy ECH privacy protection not only on browsers but also on apps and other online activities.

Pushing for Mass Adoption

OS-level support for ECH is a massive security upgrade for Android users. However, ECH has to be a two-way transaction. According to Make Use Of, “CH only works when the website and the app’s networking stack support it.”

Unfortunately, ECH support is relatively low. Dark Reading reports, “slightly fewer than 10% of the top million websites (by traffic) support ECH, and just 0.06% of connections actually use ECH.” There’s also the problem of updating to the latest Android OS. While flagship phones are more likely to receive the latest OS quickly, cheaper Android phones may take a year or two to get the update. Mobile phone manufacturers also need to get on board with integrating this type of security.

ECH helps protect the websites users visit, but their IP addresses and online activity may still be visible. User profiling is still there, but websites can be encrypted as long as the user and destination support ECH.

Securing Your Transaction

Built-in, OS-level encryption for all mobile activity is still out of reach for users. Using a VPN is still an option, but many users are not willing to pay a monthly fee for a secure connection. Free options are available, but they could do more harm than good.

It’s still up to users to secure their transactions online. Basic security measures, such as being careful about the websites you visit and limiting the information you share, are always important. Encrypting connections is highly recommended, but free tools that hide IP addresses should be used carefully. A secure, user-focused mobile OS may still be years away, but Google is taking steps to help users protect their online activities.