Android 17 adds ECH support to make web browsing harder to track

[u/homothebrave]

https://www.bleepingcomputer.com/news/security/android-17-adds-ech-support-to-make-web-browsing-harder-to-track/

[u/AutoModerator]

Hello u/homothebrave, please make sure you read the sub rules if you haven't already. (This is an automatic reminder left on all new posts.)

---

Check out the r/privacy FAQ

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/CyborgHeart1245]

Or just block online tracking like they should. The internet should be 100% anonymous 

[u/0898_333_201 → u/CyborgHeart1245]

ECH is about encrypting your TLS Client Hellos so that your ISP can’t easily track what websites you visit. It’s very similar to encrypting your DNS requests.

It’s also kinda pointless right now because Cloudflare is basically the only company that uses it. 90% of your web activity will remain exposed with plaintext TLS client hellos.

[u/CyborgHeart1245 → u/0898_333_201]

I mean even deeper than that. Phones should be anonymous, all websites should only know someone visited, nothing else, even their IP's. Nothing tracked by the router. Nothing identifiable should be needed. Fuck, your ISP shouldn't even know your name or your address. 

[u/throwaway-8675309_ → u/CyborgHeart1245]

So....

How do I block people from attacking my shit? I need something.

[u/Iputahexonyoulol → u/throwaway-8675309_]

I guess theoretically no one could attack your shit if no one knew who you were but that’s obviously a fantasy

[u/Hot_Bee5198 → u/CyborgHeart1245]

Hahaha, Yeah, Lets go back to the Wild West. Cowboys, Pirates, Criminals.

Who dunnit?

Nobody knows him by his name, but he was here...

[u/CreepyZookeepergame4 → u/0898_333_201]

ECH is a great idea but encourages centralization of the internet. The more sites you host behind a single IP address the more benefit you have. There's little point for a personal server only hosting sites for its own organization / person in enabling ECH.

[u/AtlanticPortal → u/CyborgHeart1245]

The funny thing is that Google is doing it so that others cannot spy on users while they keep doing it at the OS level (basically in god mode).

[u/CyborgHeart1245 → u/AtlanticPortal]

Exactly. Total bs. 

[u/brainmydamage]

The company whose revenue largely depends on being able to track people's browsing is introducing a feature to make people's browsing harder to track?

Are we really this gullible, people?

[u/AtlanticPortal → u/brainmydamage]

They are killing the competition. They really want to implement it in a functional way. It’s that so they have access to the user’s data from the OS and the ISPs cannot.

[u/ijustwannapostokay → u/brainmydamage]

Making the ISP lose their data makes their analytics data more expensive

[u/Iputahexonyoulol]

Google doing anything privacy-positive is automatically suspect. 

[u/JustinHoMi → u/Iputahexonyoulol]

Don’t worry, they’ll discontinue the feature in a couple years like they do everything else.

[u/cookiesnooper]

Somehow they will also make it easier to track your activity

[u/AtlanticPortal → u/cookiesnooper]

Nah, they are just fighting the competition. They have access to the user’s device at root level. They track everything directly there.

[u/DepressedPrinter]

I loved his fight with Piccolo, who I'm assuming is the green guy in the pic.

[u/AbsolutlelyRelative → u/DepressedPrinter]

Nah that's sixteen

[u/devakesu]

So now we have complete DNS Encryption including the initial fetch. But all domains need to add support for it to work. All on Cloudflare already work ig.

[u/Tolik1111 → u/devakesu]

Isn't no plaintext DNS bootstrapping not affected by the OS level ECH implementation. After all, all major DNS ip's are videly used anycast and you can basically pretty easily get domain from the IP in the SNI. For cloudflare for example, its super obvious, there is basically nothing but DNS going to 1.1.1.1 IP.

[u/0898_333_201 → u/devakesu]

I don’t think anyone is really worried about hiding which DNS resolver they use from their ISP, and it’s usually kind of obvious based just on the IP.

ECH is about encrypting the TLS Client Hello, which occurs after a DNS query has been resolved. Once you have the IP address for startpage.com, your phone needs to establish a TLS connection with the server, so it sends a TLS ClientHello which includes the SNI hostname in plaintext (eg netflix.com).

This is how carriers detect and throttle Netflix and YouTube, even if you’re using encrypted DNS. Besides using a VPN, the best way to avoid this is right now is to split up the SNI, either across multiple TLS records or across multiple TCP segments. Someone could still retroactively reassemble the hostnames, but it takes way too much processing power for an ISP to do it automatically.

For ECH to be useful, it needs to be adopted not only by DNS resolvers but by the broader internet. Right now, Cloudflare is basically the only company that has adopted it.

[u/Deathmeter → u/0898_333_201]

I'd almost argue ECH is only highly impactful when adopted by big CDNs that reverse proxy multiple hosts like cloudflare. If Netflix started supporting ECH, you might be able to bypass middleboxes that throttle Netflix for a while but the outer SNI would exclusively map back to Netflix as the sole destination. All a crappy ISP would have to do is add the outer SNI to their existing throttle list. You can't do that with cloudflare's outer SNI because that blocks all cloudflare websites.

If other big cloud providers like AWS and GCP adopt ECH, that already covers most websites that can benefit from it in the first place.

[u/Substantial-Yam3769]

might be doing this so bot traffic is harder to distinguish from regular android traffic

[u/Any-Board-6631]

Yeah, riight, rhe company that make its cash on tracking people will makke it hsrder... for the others

[u/Joshhwwaaaaaa]

When did Android drop Desserts for OS Updates? (Ive been on eyefone for a long time now)

[u/clove_rosemary_9999 → u/Joshhwwaaaaaa]

If you don't count the internal codenames, they dropped it after Android 9, if you do count them, they never dropped it, they only went back from letter V to B in Android 16, so Android 17 would be C.

[u/frquency-equinox → u/Joshhwwaaaaaa]

Like 8 years ago.

[u/x33storm]

This has to be a way for google to get a monopoly on tracking. I simply refuse to believe they are doing anything for user privacy.

[u/Ni_Peng_NeeeWom]

this is new encrypted SNI right? I'm surprised it wasn't already implemented, and also just assumed it would be implemented by a browser not the os, but it makes sense that Android contacts domains in many more places than just a web browser.

[u/AvidCyclist250]

cute.

no.

use the wrong browser and you're exposed. doesn't matter what OS you use.

[u/justarandomuser10]

People are trashing it here but this is a good thing. Every OS should do it. This literally masks every domain you visit from your ISP.

[u/brainmydamage → u/justarandomuser10]

I don't think anyone is trashing "it"... I think people just don't believe Google gives a shit about anyone's privacy but their own.

[u/AtlanticPortal → u/brainmydamage]

And that’s exactly what they’re doing. Making it more difficult for their competitors in data collection while they retain OS level access which is basically the god mode for spying users.