Security Independently confirmed 4 publishers 2 min read Published Aug 28, 2026, 3:39 AM PDT Updated Sep 2, 2026, 8:23 PM PDT

Android 17 encrypts the handshake field enterprise filters still read

Google's Encrypted Client Hello rollout, wrapped in GREASE decoys so protected sessions look like everything else, removes the plaintext domain that SNI-based logging keys on. Jigsaw reports near-zero interference even in Russia and China.

The Watch · Security desk

Send a correction

What happened

Android 17 adds Encrypted Client Hello, which encrypts the destination domain under a key only the target server can unlock and works alongside private DNS to conceal where a connection is going.
Jigsaw sent GREASE requests to the top 10,000 domains worldwide and reported connection success holding steady against ordinary TLS.
A second Jigsaw run covered 202 countries and 740 ISPs, including heavily filtered networks in Russia and China, and found interference near zero everywhere.

Why it matters

What it limits constraint Corporate Wi-Fi and egress logs stop yielding a per-domain record of where Android traffic went, so domain blocklists on the wire degrade toward IP and app-level decisions.
Who has to decide decision The cheapest lever left is the resolver: keep managed handsets on an enterprise DNS path, or move domain policy onto the device through MDM or into a TLS-terminating proxy.
What's now possible capability An Android implant that uses a stock networking library inherits destination concealment for free, and its handshakes look like every other app's.
What it sets up precedent With Google claiming mobile first-mover status, the pressure now sits on other platforms to match it and on filtering vendors to justify products built around a field that is going away.

Next story · Security · 2d ago

XBOW built a Windows Chrome exploit chain in six days with about $40,000 of AI compute

Confirmed4 publishers

The field that goes dark is the plaintext domain name in the TLS handshake, the one Google's own engineers describe as readable by network operators and eavesdroppers even when the session is encrypted ^[6]. ECH wraps it in a key only the destination server holds ^[2], so an on-path device stops reading the name ^[12]. Nick Sullivan, co-author of the standard, called Android support a step toward closing one of the largest remaining structural privacy holes on the internet ^[16]. For a filtering appliance, it is the removal of the field the policy is written against.

GREASE is the part with operational teeth. Because server-side support is uneven, Android sends decoy encrypted extensions on connections that are not protected at all, so an observer cannot separate the two by shape ^[3]. A rule that flags or drops handshakes carrying an ECH-shaped extension therefore lands on ordinary traffic from any app built on a supporting library, which turns a targeted control into a blanket one ^[13].

This arrives gradually. ECH is on by default only for apps that target Android 17 and run on a library that supports it, listed as newer OkHttp, WebView and HttpEngine ^[5], and web server support is still patchy ^[3]. The announcement was reported on 28 August 2026 ^[1], with Google claiming Android is the first major mobile operating system to ship broad ECH support ^[11]. The loss of domain visibility tracks two curves defenders do not control: app retargeting and server adoption.

Jigsaw's validation was about connectivity, not about enterprise policy. One test pushed GREASE requests at the top 10,000 domains and found success rates level with ordinary TLS ^[9]. The second covered 202 countries and 740 ISPs, including Russia and China, with interference near zero ^[10]. That averages roughly 3.7 ISPs per country ^[14], wide coverage and thin per market, and the reported scope is consumer ISP paths rather than corporate middleboxes configured to require a readable domain ^[18]. Networks that fail closed on unfamiliar TLS extensions were not the population under test.

Three other changes shipped alongside. Local Network Protection makes apps request permission before scanning or connecting to other devices on the local network ^[4], which matters if you run device discovery or printer apps on BYOD handsets. Certificate Transparency on by default ^[7] and operator-side 2G shutoff for subscribers ^[8] are straight gains that cost monitoring teams nothing. ECH is the only item on the list that takes something away from the defender's side of the wire.

What to watch

Whether server-side ECH adoption at large CDNs rises enough for the plaintext domain to disappear at scale rather than in patches.
Whether Google ships an enterprise policy control to manage or disable ECH on managed Android devices.
Whether filtering vendors and national censors respond by blocking at the IP layer or by dropping ECH-bearing handshakes wholesale.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence56
Adoption33
Hype gap+16
Incentives74
Confidence63

Perspective Coverage

4 publishers

Builder: Builder 34%
Operator: Operator 55%
Investor: Investor 11%

Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
Helpnetsecurity reported Google's Android 17 network security changes on 28 August 2026.
Reported SupportedView cited source
[2]
Android 17 adds support for Encrypted Client Hello, which encrypts the domain name with a key only the destination server can unlock and works together with private DNS to keep the destination hidden from outside observers.
Reported SupportedView cited source
[3]
Because ECH support among web servers is still uneven, apps and browsers also send GREASE, a decoy version of the encrypted extension, so an outside observer cannot tell which connections are protected just by looking at their shape.
Reported SupportedView cited source
[4]
Local Network Protection in Android 17 makes apps ask before they can scan or connect to other devices on the user's local network, closing a route apps used to profile a household via smart TVs, cameras and consoles.
Reported SupportedView cited source
[5]
For apps targeting Android 17, ECH turns on by default as long as the app runs on a networking library that supports it, such as newer versions of OkHttp, WebView or HttpEngine.
Reported SupportedView cited source
[6]
Google software engineer Bram Bonne and product manager Shuaibo Huang said that when a user visits a website or uses an app, even if the connection is encrypted by HTTPS, the domain names of the sites visited remain visible to network operators and eavesdroppers, and that this unencrypted data can be used to build user profiles or for targeted phishing and scam campaigns.
Reported Supported Source: Google engineers Bram Bonne and Shuaibo HuangView cited source
[7]
Certificate Transparency is on by default in Android 17, forcing certificates into a public log so forged ones are harder to slip through unnoticed.
Reported SupportedView cited source
[8]
Participating mobile operators can switch off 2G for their subscribers with no action needed from the user, reducing exposure to SMS blasters, the fake base stations that force phones onto older insecure networks to push phishing texts.
Reported SupportedView cited source
[9]
In Jigsaw's first test, GREASE requests went out to the top 10,000 domains worldwide and connection success held steady compared with ordinary TLS.
Reported SupportedView cited source
[10]
In Jigsaw's second test, requests were run through 202 countries and 740 ISPs, including heavily filtered networks such as Russia and China, and interference stayed near zero everywhere.
Reported SupportedView cited source
[11]
Google says Android is the first major mobile operating system to roll out broad ECH support, and that it is working with Jigsaw and app developers to speed up adoption.
Reported Supported Source: GoogleView cited source
[12]
ECH removes the plaintext server-name field in the TLS handshake, commonly logged as SNI, from what devices on the network path can read.
Derived Supported
[13]
A monitoring rule keyed on the presence of an ECH-shaped extension cannot distinguish protected connections from GREASE decoys, so it applies to all traffic from apps on supporting libraries rather than to a targeted subset.
Derived Supported
[14]
Jigsaw's country-level test averaged about 3.7 ISPs sampled per country.
Derived Supported
[15]
Because Google's design pairs ECH with private DNS to hide the destination, a network that still performs name resolution for the device continues to see the domain in the DNS query.
Derived Supported
[16]
Nick Sullivan, co-author of the ECH standard and founder of Cryptography Consulting LLC, said ECH support for Android is a huge step towards closing one of the largest remaining structural privacy holes left on the internet.
Reported Supported Source: Nick Sullivan, co-author of the ECH standardView cited source
[17]
Malware running on Android 17 through a standard supporting networking library obtains the same destination concealment as legitimate apps, without needing a custom protocol or unusual traffic shape.
Derived Supported
[18]
The Jigsaw validation described covers top-domain reachability and consumer ISP paths across countries; no test against enterprise middleboxes is described.
Derived Insufficient

Sources

4 independent publishers whose own reporting we read for this story.

bleepingcomputer.com
1 article · August 27, 2026
Android 17 adds ECH support to make web browsing harder to track
helpnetsecurity.com
1 article · August 28, 2026
Android 17 adds new protections against sneaky Wi-Fi tracking and web snooping
scworld.com
1 article · August 28, 2026
Android 17 enhances network privacy with Encrypted Client Hello
thehackernews.com
2 articles · August 29, 2026
Android 17 Adds OS-Wide ECH to Hide Website Visits From Network Providers

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Builder34%

For anyone shipping an Android app, the operative sentence is that ECH switches on by itself once you target Android 17 and sit on a recent OkHttp, WebView or HttpEngine. The Hacker News is the only outlet that follows that to the library — OkHttp carrying ECH in its core — while Help Net Security and BleepingComputer state the default and move on. Nobody in this reporting discusses what the change does to your debugging: with GREASE in play, your own traffic captures stop distinguishing a protected session from a decoy just as reliably as an eavesdropper's do.

Operator55%

This is a client-side change that quietly retires a field defenders read. Only BleepingComputer names it — the Server Name Indication — and only BleepingComputer notes the corollary that hostnames remain exposed on servers without ECH, which means visibility degrades unevenly rather than cleanly. Jigsaw's numbers, 10,000 domains and 740 ISPs across 202 countries, are about whether connections still succeed, not about whether corporate inspection gear tolerates them; the average works out to under four providers per country, and no enterprise path is described anywhere in the coverage. The rest of the package — permission-gated local network scanning, Certificate Transparency by default, carrier-side 2G shutoff — reads as straightforwardly good news for the same teams.

Investor11%

There is little here to price. Google is the announcer, Google's Jigsaw is the tester, Google's engineers are the quoted authorities, and the sole outside voice — ECH co-author Nick Sullivan, in Help Net Security alone — runs a cryptography consultancy. No coverage carries device counts, app adoption figures, carrier names for the 2G opt-in, or any cost to ISPs whose commercial profiling of destination data this is explicitly designed to break. The one durable signal is directional: the platform default now works against network-level audience data, and that is a business-model fact for anyone monetising it.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence56: 0100
One blog post, four bylines
Every technical assertion here — the encrypted field, the decoy extensions, the two test results — originates in Google's announcement and Jigsaw's companion report. The four publishers are consistent because they are downstream of the same document: SC World says so explicitly by crediting BleepingComputer, and The Hacker News appears twice in our coverage. Where the accounts drift apart, on Firefox versions, nobody checked. The mechanism claims are strong on their merits; the sourcing is a single stream.
Adoption33: 0100
Default-on behind two upgrades
The default is real but doubly conditional: an app has to target Android 17 and ride a recent OkHttp, WebView or HttpEngine. OkHttp shipping ECH in its core library is the most concrete adoption fact in the coverage. Against that, GREASE exists precisely because server-side support is patchy, and no publisher offers a device figure, an app count, or the name of a single participating carrier for the 2G switch. Browsers got here first; this is the platform catching up.
Hype gap+16: −100 understated0 aligned+100 overstated
Reach oversold, residue undersold
Two things pull in the same direction. Google's first-major-mobile-OS line and Sullivan's largest-remaining-structural-hole framing sit alongside the fact, which only The Hacker News supplies, that ECH has been in Chrome and Firefox for years. And the residue goes largely unexamined: hiding the destination depends on private DNS, so a network still doing resolution for the phone keeps the domain, and on servers without ECH the hostname travels in the clear behind the decoy. Modest overstatement rather than vapour — the mechanism does what is claimed, within limits the coverage mostly leaves offstage.
Incentives74: 0100
Announcer, tester and cheerleader under one roof
Google ships the feature, Google's Jigsaw runs the validation, Google's engineers and its Android security VP supply the quotes, and the external endorsement comes from a man who co-wrote the standard and founded a cryptography consultancy. There is also a commercial seam in the reporting itself: BleepingComputer's piece ends in a pitch for a vendor simulation report, and SC World's closes on a network-security marketing line. None of this makes the ECH claims wrong; it does mean nobody in the chain has an interest in finding the seams.
Confidence63: 0100
Confident on mechanism, thin on consequences
What ECH and GREASE do is described the same way by every publisher and matches the standard, so we hold those claims firmly. Our confidence falls off sharply past the mechanism: adoption breadth, enterprise-network behaviour, DNS-path residue and abuse by malware on the same default libraries are all inference rather than reporting here.

Topics and entities

Topics

Network Visibility and Filtering
Encrypted Client Hello
Mobile Platform Privacy
Cellular downgrade attacks
Censorship and Interference Measurement