Android 17 Enables System-Wide ECH and 2G Lockdown, Stripping Carrier Visibility Into App Traffic

Google announced OS-level Encrypted Client Hello support in Android 17, extending the feature previously limited to Chrome 117 and Firefox 118. The change encrypts the Server Name Indication field in all outbound TLS handshakes and activates ECH GREASE on unsupported servers so every connection appears identical. OkHttp integration allows third-party apps to inherit the protection without additional code. Parallel controls require explicit user consent for local network scanning and let carriers disable 2G at the network level rather than device settings.

The technical pattern shows Google closing metadata channels that carriers and DPI vendors have used for profiling since the SNI era. Certificate Transparency is now enforced by default, and the 2G toggle moves from user or MDM option to zero-click carrier policy. These moves align with earlier Android releases that hardened private DNS and removed cleartext fallback, consistently shifting visibility from the network edge to the endpoint.

Carriers lose granular domain logs that previously supported traffic management and lawful intercept requests. Independent measurements of ECH deployment on major CDNs indicate roughly 35 percent of top domains already advertise keys; the remaining gap means partial protection until server adoption rises. The combination of ECH, local-network gating, and 2G removal creates a coherent defensive stack against both passive surveillance and active base-station attacks.

Next phase hinges on server key publication rates and carrier firmware updates. If ECH coverage exceeds 70 percent of popular domains within 12 months, residual SNI leakage drops below practical correlation thresholds for most consumer traffic.