---
title: "Android 17 hides visited websites from ISPs and blocks covert Wi-Fi scanning: what changed in security"
description: "Google has implemented ECH encryption, local network protection against covert scanning, and automatic 2G shutdown in Android 17. ISPs no longer see visited websites, although ECH coverage in apps is still incomplete."
date: 2026-08-28T12:22:01.000Z
lang: en
url: https://xab.info/en/posts/android-17-privacy-ech-local-network-protection
tags: [android-17, encrypted-client-hello, google-security, privacy, wi-fi, certificate-transparency]
publisher: "XAB.info"
---

# Android 17 hides visited websites from ISPs and blocks covert Wi-Fi scanning: what changed in security

![Google logo on a building: the company prepares Android 17 with enhanced privacy protection and hidden Wi-Fi scanning blocking](https://xab.info/media/2026/08/28/android-17-zashita-privatnosti-ech-lokalnaya-set/android-17-zashita-privatnosti-ech-lokalnaya-set-1.webp)

## 🎯 Key Points

- Android 17 introduces the ECH protocol, which encrypts the domain name in the first TLS connection packet, hiding visited sites from ISPs
- Local Network Protection forbids apps from scanning the home Wi-Fi network without explicit user consent
- Carriers have received a tool to automatically disable 2G by default, blocking attacks via fake base stations
- The Certificate Transparency registry is enabled by default to protect against fake web certificates
- Fully hiding an IP address still requires a VPN, and ECH is not yet supported in all apps in the ecosystem

Google has unveiled a major update to network security in Android 17, affecting several vulnerable areas at once: from the transmission of metadata during HTTPS connection setup to protection against physical attacks via fake base stations. This is reported by RBC-Ukraine, citing the official Google Security Blog. As of 28 August 2026, the update is already rolling out to supported devices, and the key technological shift is the move to the Encrypted Client Hello (ECH) protocol, which plugs one of the most well-known privacy gaps for mobile users.

### Domain name encryption: your ISP no longer sees which site you open

Previously, when a TLS connection was established, the name of the target site (SNI — Server Name Indication) was transmitted in plaintext in the first data packet. This allowed internet service providers, carriers, and any observer along the traffic path to build a detailed profile of a user's interests: which sites they visit, which apps they use, and which services they connect to. Such information could be used for targeted advertising, and in the worst case for phishing attacks or surveillance. In Android 17, the ECH protocol encrypts the target domain name already in the first packet. The internet service provider sees only the fact of a connection to a content delivery network (for example, Cloudflare or Akamai) and the overall volume of traffic, but not the specific site or app. For developers, this means migrating to OkHttp version 5.5.0 libraries and optimizing DNS requests. It is important to understand, however: to fully hide a device's IP address, users will still need a VPN, since ECH protects only the connection metadata, not the source address itself.

### Local network: the end of the era of unauthorized Wi-Fi scanning

The changes also affect how mobile apps behave on home networks. Prior to Android 17, any app could scan the local Wi-Fi network without additional permissions, identifying all connected devices — from smart TVs and routers to surveillance cameras and wearable gadgets. This created a serious risk: a malicious or even a legitimate but overly "greedy" app could map out an entire home network. Android 17 introduces a Local Network Protection mechanism: apps can no longer independently query devices on the local network — any scanning now requires explicit user consent. For casting content to a TV or another screen, a system-level secure casting tool has been implemented, which sends the signal to the chosen display without granting the app access to the rest of the home network.

### Certificate Transparency registry and protection against fake certificates

Another innovation is the enabled-by-default verification of website authenticity through the public Certificate Transparency (CT) registry. All issued security certificates must now be logged in an open registry, which makes forging encryption keys virtually impossible even in the event of a certificate authority compromise. If an attacker attempts to issue a fake certificate for a known domain, it will be immediately detected by the absence of a record in the CT registry, and Android 17 will block the connection before the user sees the fake page.

### Automatic 2G shutdown: eliminating the "SMS blaster" attack vector

Google has also paid special attention to protection against so-called "SMS blasters" — portable devices that mimic cellular base stations. Attackers deploy these relatively cheap devices in crowded places, jam LTE and 5G signals, and forcibly switch victims' smartphones to the outdated, unprotected 2G standard. On a 2G network, a device becomes vulnerable to mass spam campaigns and phishing SMS that bypass carrier filters. If Android 12 introduced only the ability to manually disable 2G at the hardware settings level, Android 17 introduces a zero-click solution: mobile carriers have received a tool to automatically disable 2G by default for all their subscribers. This completely eliminates this attack vector "out of the box," with no user involvement whatsoever.

### Contradictory data

Although Google positions ECH as a full-fledged privacy protection mechanism, the publication NotebookCheck notes a significant caveat: domain name encryption does not yet work in all apps. Adopting ECH requires developers to update their networking libraries to OkHttp 5.5.0, and at the time of the Android 17 release, some apps — especially outdated ones or those developed by small studios — may still be transmitting SNI in plaintext. Thus, the real level of protection depends on how quickly the developer ecosystem adapts to the new requirements. At the same time, RBC-Ukraine and 3DNews emphasize that at the system level (Chrome browser, system services) ECH works properly and covers the bulk of user traffic. The gap between "full protection" in Google's marketing materials and "protection not in all apps" in independent reviews is not a direct factual contradiction, but a difference in the scale of deployment: the technology is implemented, but its coverage across the app ecosystem remains dynamic.

### Practical implications for users and developers

For the average user, Android 17 means that from the moment of update, the sites they visit stop being visible to the ISP and carrier, the home Wi-Fi network is protected from covert scanning by third-party apps, and the risk of interception via fake 2G stations is reduced to zero without any action on their part. For mobile app developers, the update brings concrete obligations: migrating to OkHttp 5.5.0, revising DNS strategies, and testing local network scenarios with the new permissions in mind. Experts note that the combination of measures in Android 17 forms the most comprehensive network security package in the platform's history — from the transport layer (ECH) to the radio-frequency layer (2G shutdown) and the local layer (Local Network Protection).

## 🔍 Fact-Check Verification

- [Your smartphone may have been covertly scanned over Wi-Fi: Android 17 changes this](https://www.rbc.ua/ukr/news/smartfon-mogli-prihovano-skanuvati-cherez-1787910599.html) - Подтверждает защиту локальной сети, ECH, CT-реестр и отключение 2G. Основной источник фактологии.
- [Android 17 hides the sites you visit, but not in all apps](https://www.notebookcheck-ru.com/Android-17-skryvaet-poseshchaemye-vami-saity-no-ne-vo-vsekh-prilozhenijakh.1381711.0.html) - Уточняет, что ECH не работает во всех приложениях из-за необходимости обновления до OkHttp 5.5.0. Использовано в блоке противоречивых данных.
- [Android 17 will hide the names of visited sites from ISPs](https://news.rambler.ru/tech/56975164-android-17-spryachet-ot-provayderov-nazvaniya-poseschaemyh-saytov/) - Подтверждает механизм ECH и сокрытие SNI от провайдеров.
- [Android 17 will hide from carriers which sites users visit](https://3dnews.ru/1147638/android-17-skroet-ot-operatorov-kakie-sayti-poseshchayut-polzovateli) - Подтверждает сокрытие посещаемых сайтов от операторов связи.

## ❓ FAQ

### Q: What is Encrypted Client Hello and how does it work in Android 17?
**A:** ECH is a protocol that encrypts the target domain name (SNI) in the first TLS connection packet. In Android 17, the ISP sees only the fact of a connection to a CDN and the traffic volume, but not the specific site. Fully hiding the IP address additionally requires a VPN.

### Q: Can apps scan my home Wi-Fi network in Android 17?
**A:** No. The Local Network Protection mechanism forbids apps from independently querying devices on the local network without explicit user consent. For casting content to a TV, a system-level secure casting tool is used.

### Q: How does Android 17 protect against fake 2G base stations?
**A:** Carriers have received a tool to automatically disable 2G by default for all subscribers. This is a zero-click solution: the user does not need to configure anything, and the SMS blaster attack vector is eliminated "out of the box."

### Q: Does ECH work in all apps immediately after the update?
**A:** No. To support ECH, developers must update their networking libraries to OkHttp 5.5.0. At the system level (Chrome browser, system services) the protocol works properly, but some third-party apps may still transmit SNI in plaintext until they are updated.

### Q: What is Certificate Transparency and why is it needed?
**A:** CT is a public registry of all issued SSL/TLS certificates. In Android 17, verification against this registry is enabled by default: if a site's certificate is absent from the registry, the connection is blocked. This protects against key forgery even in the event of a certificate authority compromise.