Android 17 hides visited websites from ISPs and blocks covert Wi-Fi scanning: what changed in security

Google has unveiled a major update to network security in Android 17, affecting several vulnerable areas at once: from the transmission of metadata during HTTPS connection setup to protection against physical attacks via fake base stations. This is reported by RBC-Ukraine, citing the official Google Security Blog. As of 28 August 2026, the update is already rolling out to supported devices, and the key technological shift is the move to the Encrypted Client Hello (ECH) protocol, which plugs one of the most well-known privacy gaps for mobile users.

Domain name encryption: your ISP no longer sees which site you open

Previously, when a TLS connection was established, the name of the target site (SNI — Server Name Indication) was transmitted in plaintext in the first data packet. This allowed internet service providers, carriers, and any observer along the traffic path to build a detailed profile of a user's interests: which sites they visit, which apps they use, and which services they connect to. Such information could be used for targeted advertising, and in the worst case for phishing attacks or surveillance. In Android 17, the ECH protocol encrypts the target domain name already in the first packet. The internet service provider sees only the fact of a connection to a content delivery network (for example, Cloudflare or Akamai) and the overall volume of traffic, but not the specific site or app. For developers, this means migrating to OkHttp version 5.5.0 libraries and optimizing DNS requests. It is important to understand, however: to fully hide a device's IP address, users will still need a VPN, since ECH protects only the connection metadata, not the source address itself.

Local network: the end of the era of unauthorized Wi-Fi scanning

The changes also affect how mobile apps behave on home networks. Prior to Android 17, any app could scan the local Wi-Fi network without additional permissions, identifying all connected devices — from smart TVs and routers to surveillance cameras and wearable gadgets. This created a serious risk: a malicious or even a legitimate but overly "greedy" app could map out an entire home network. Android 17 introduces a Local Network Protection mechanism: apps can no longer independently query devices on the local network — any scanning now requires explicit user consent. For casting content to a TV or another screen, a system-level secure casting tool has been implemented, which sends the signal to the chosen display without granting the app access to the rest of the home network.

Certificate Transparency registry and protection against fake certificates

Another innovation is the enabled-by-default verification of website authenticity through the public Certificate Transparency (CT) registry. All issued security certificates must now be logged in an open registry, which makes forging encryption keys virtually impossible even in the event of a certificate authority compromise. If an attacker attempts to issue a fake certificate for a known domain, it will be immediately detected by the absence of a record in the CT registry, and Android 17 will block the connection before the user sees the fake page.

Automatic 2G shutdown: eliminating the "SMS blaster" attack vector

Google has also paid special attention to protection against so-called "SMS blasters" — portable devices that mimic cellular base stations. Attackers deploy these relatively cheap devices in crowded places, jam LTE and 5G signals, and forcibly switch victims' smartphones to the outdated, unprotected 2G standard. On a 2G network, a device becomes vulnerable to mass spam campaigns and phishing SMS that bypass carrier filters. If Android 12 introduced only the ability to manually disable 2G at the hardware settings level, Android 17 introduces a zero-click solution: mobile carriers have received a tool to automatically disable 2G by default for all their subscribers. This completely eliminates this attack vector "out of the box," with no user involvement whatsoever.

Contradictory data

Although Google positions ECH as a full-fledged privacy protection mechanism, the publication NotebookCheck notes a significant caveat: domain name encryption does not yet work in all apps. Adopting ECH requires developers to update their networking libraries to OkHttp 5.5.0, and at the time of the Android 17 release, some apps — especially outdated ones or those developed by small studios — may still be transmitting SNI in plaintext. Thus, the real level of protection depends on how quickly the developer ecosystem adapts to the new requirements. At the same time, RBC-Ukraine and 3DNews emphasize that at the system level (Chrome browser, system services) ECH works properly and covers the bulk of user traffic. The gap between "full protection" in Google's marketing materials and "protection not in all apps" in independent reviews is not a direct factual contradiction, but a difference in the scale of deployment: the technology is implemented, but its coverage across the app ecosystem remains dynamic.

Practical implications for users and developers

For the average user, Android 17 means that from the moment of update, the sites they visit stop being visible to the ISP and carrier, the home Wi-Fi network is protected from covert scanning by third-party apps, and the risk of interception via fake 2G stations is reduced to zero without any action on their part. For mobile app developers, the update brings concrete obligations: migrating to OkHttp 5.5.0, revising DNS strategies, and testing local network scenarios with the new permissions in mind. Experts note that the combination of measures in Android 17 forms the most comprehensive network security package in the platform's history — from the transport layer (ECH) to the radio-frequency layer (2G shutdown) and the local layer (Local Network Protection).