Recently, Google announced four advanced security features in Android 17 that secure your connections, defend against cellular vulnerabilities, and help keep your home network private.
4 new security features in Android 17
Encrypted Client Hello (ECH)
When you visit a website or use an app, even if the connection is encrypted by HTTPS, the domain names of the sites you visit are still visible to network operators and eavesdroppers.
Android 17 is introducing support for Encrypted Client Hello (ECH). This new privacy standard works in tandem with private DNS to obscure the domain names you visit, hiding metadata that can be used to profile you. ECH helps ensure that, for supported websites and apps, network providers and network snoopers can no longer easily see which websites or apps you are accessing.
Google is working with industry leaders, service providers, and app developers to accelerate ECH adoption. Android 17 is the first major mobile OS to enable broad ECH support.
To adopt these modern networking libraries and best practices, Android app developers should upgrade to OkHttp 5.5.0 and enable ECH.
Local Network Protection
Local Network Protection is now enforced in Android 17 to help keep your local network secure. Apps must now ask for your permission before they can scan or connect to other devices on your local network.
Earlier, apps were able to scan your local network to see what other devices were connected without your permission.
For everyday tasks like casting a video to your TV, developers should adopt a secure system tool that allows you to select your TV without the app ever needing permission to see the other devices in your home.
Certificate Transparency
When you connect to a secure app or website, your device verifies a certificate to confirm the site is authentic. However, if a certificate issuer is compromised, hackers could potentially create fake certificates to intercept your traffic and cause harm. To address this, Android is enabling Certificate Transparency (CT) by default, requiring all certificates to be logged in a public registry, making such an attack much less likely to go unnoticed.
Closing a security loophole to block 2G text scams
Scammers are increasingly turning to portable devices known as “SMS blasters” or false cellular base stations to target mobile users in dense public spaces. These devices operate by broadcasting high-power signals that force nearby smartphones to drop their LTE or 5G connections and downgrade to less secure, legacy 2G networks. Once a phone is on a 2G network, scammers can bypass modern spam and scam filters to deliver realistic phishing texts directly to victims’ devices.
To safeguard users, Android 12 introduced a manual toggle allowing users to disable 2G at the hardware level. And now, further addressing this loophole, Android 17 comes with a zero-click solution, empowering mobile carriers to turn off 2G by default for their subscribers.
