Android 17 Strengthens Network Security With Hidden Domain Names and New 2G Controls

Google is introducing several network security and privacy upgrades in Android 17, including technology that hides website domain names from network observers, stronger protections against insecure 2G connections, tighter local network permissions, and new certificate safeguards. The changes are designed to reduce opportunities for tracking, phishing, and traffic interception across Android devices.

Android 17 Uses Encryption to Hide Domain Names

HTTPS already encrypts much of the information exchanged between a device and a website, but domain names can still be exposed during certain stages of a connection. That means network operators or potential eavesdroppers may be able to determine which websites or online services a person is accessing.

According to Google, this information could be used to create profiles of users. In more malicious scenarios, exposed domain information could also assist targeted phishing or scam campaigns.

Android 17 addresses the issue by adding operating-system support for Encrypted Client Hello, or ECH. Working alongside private DNS, ECH is designed to “obscure the domain names you visit.”

The technology encrypts the destination domain name using a key that can be decrypted by the intended website. As a result, supported websites and apps can prevent network providers and other observers from easily identifying the online destinations users are accessing.

Developers Need to Enable ECH Support

Domain information can traditionally leak through two parts of the connection process: the initial DNS lookup and the unencrypted ClientHello portion of the Transport Layer Security, or TLS, handshake.

Encrypted DNS has already helped address the first issue. ECH support in Android 17 targets the second by protecting information exposed during the TLS connection process.

With operating-system support now available, developers must upgrade their apps to OkHttp 5.5.0 and enable ECH to take advantage of the feature.

Mobile Carriers Can Disable 2G by Default

Android 17 also expands protections against security risks associated with aging 2G cellular networks.

Mobile carriers can now disable 2G connectivity by default for their customers. Android 12 previously introduced a setting that allowed individual users to disable 2G themselves.

The change is intended in part to counter SMS blaster attacks. These attacks can force nearby smartphones to disconnect from LTE or 5G networks and downgrade to older, less secure 2G connections.

Once a device has been pushed onto the legacy network, attackers may attempt to deliver phishing text messages or carry out other forms of mobile network abuse.

Allowing carriers to disable 2G by default provides another layer of protection, particularly as U.S. wireless networks continue relying primarily on 4G LTE and 5G technology.

Apps Face Stricter Local Network Permissions

Android 17 is also enforcing Local Network Protection, requiring apps to obtain permission before scanning for or connecting to other devices on a user’s local network.

The restriction is intended to prevent apps from unnecessarily discovering devices connected to the same home or workplace network.

Casting Can Work Without Broad Network Access

Google says developers can use secure system tools for common activities such as casting video to a television.

Instead of giving an app permission to view every device on a home network, Android can present a system interface that lets the user select a TV directly. The app can then establish the necessary connection without receiving broader visibility into other connected devices.

This approach follows Android’s broader shift toward limiting apps to only the permissions required for a specific task.

Certificate Transparency Adds Another Security Layer

Android 17 is also strengthening Certificate Transparency protections.

When a user connects to a secure website or app, the device checks its digital certificate to verify that the destination is authentic. A compromised certificate authority, however, could potentially allow attackers to create fraudulent certificates and attempt to intercept encrypted traffic.

Certificate Transparency requires certificates to be recorded in a public registry, making suspicious or improperly issued certificates more likely to be detected.

Android 17 Expands Privacy Across Multiple Network Layers

Taken together, Android 17’s network security updates address several different attack surfaces. ECH reduces exposure of domain names, carrier-level 2G controls help defend against downgrade attacks, Local Network Protection restricts unnecessary access to nearby devices, and Certificate Transparency strengthens defenses against fraudulent certificates.

For Android users in the United States and elsewhere, the changes represent another step toward making routine mobile connections more private while reducing the amount of network information potentially available to malicious actors.

Ernest Hemingway

Ernest Hemingway is a contributor at Thecherawchronicle.com, covering a wide range of topics including news, politics, business, technology, sports, entertainment, and lifestyle. He focuses on delivering clear, balanced reporting and useful information that helps readers stay informed about current events and issues that matter to their communities. His work emphasizes accuracy, relevance, and accessibility, bringing readers timely stories and practical insights in a straightforward and engaging way.