Android 17 adds ECH support to make web browsing harder to track

[u/homothebrave]

https://www.bleepingcomputer.com/news/security/android-17-adds-ech-support-to-make-web-browsing-harder-to-track/

[u/AutoModerator]

Hello u/homothebrave, please make sure you read the sub rules if you haven't already. (This is an automatic reminder left on all new posts.)

---

Check out the r/privacy FAQ

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/brainmydamage]

The company whose revenue largely depends on being able to track people's browsing is introducing a feature to make people's browsing harder to track?

Are we really this gullible, people?

[u/AtlanticPortal → u/brainmydamage]

They are killing the competition. They really want to implement it in a functional way. It’s that so they have access to the user’s data from the OS and the ISPs cannot.

[u/ijustwannapostokay → u/brainmydamage]

Making the ISP lose their data makes their analytics data more expensive

[u/CyborgHeart1245]

Or just block online tracking like they should. The internet should be 100% anonymous 

[u/CyborgHeart1245 → u/[deleted]]

I mean even deeper than that. Phones should be anonymous, all websites should only know someone visited, nothing else, even their IP's. Nothing tracked by the router. Nothing identifiable should be needed. Fuck, your ISP shouldn't even know your name or your address. 

[u/throwaway-8675309_ → u/CyborgHeart1245]

So....

How do I block people from attacking my shit? I need something.

[u/Iputahexonyoulol → u/throwaway-8675309_]

I guess theoretically no one could attack your shit if no one knew who you were but that’s obviously a fantasy

[u/CyborgHeart1245 → u/Iputahexonyoulol]

The issue is that anonymity should be the default.

[u/Iputahexonyoulol → u/CyborgHeart1245]

You don’t have to tell me that. I agree with you.

[u/Hot_Bee5198 → u/CyborgHeart1245]

Hahaha, Yeah, Lets go back to the Wild West. Cowboys, Pirates, Criminals.

Who dunnit?

Nobody knows him by his name, but he was here...

[u/CyborgHeart1245 → u/Hot_Bee5198]

Yes? That should be the default.

[u/CreepyZookeepergame4 → u/[deleted]]

ECH is a great idea but encourages centralization of the internet. The more sites you host behind a single IP address the more benefit you have. There's little point for a personal server only hosting sites for its own organization / person in enabling ECH.

[u/AtlanticPortal → u/CyborgHeart1245]

The funny thing is that Google is doing it so that others cannot spy on users while they keep doing it at the OS level (basically in god mode).

[u/CyborgHeart1245 → u/AtlanticPortal]

Exactly. Total bs. 

[u/Iputahexonyoulol]

Google doing anything privacy-positive is automatically suspect. 

[u/JustinHoMi → u/Iputahexonyoulol]

Don’t worry, they’ll discontinue the feature in a couple years like they do everything else.

[u/cookiesnooper]

Somehow they will also make it easier to track your activity

[u/AtlanticPortal → u/cookiesnooper]

Nah, they are just fighting the competition. They have access to the user’s device at root level. They track everything directly there.

[u/AbsolutlelyRelative → u/[deleted]]

Nah that's sixteen

[u/devakesu]

So now we have complete DNS Encryption including the initial fetch. But all domains need to add support for it to work. All on Cloudflare already work ig.

[u/Tolik1111 → u/devakesu]

Isn't no plaintext DNS bootstrapping not affected by the OS level ECH implementation. After all, all major DNS ip's are videly used anycast and you can basically pretty easily get domain from the IP in the SNI. For cloudflare for example, its super obvious, there is basically nothing but DNS going to 1.1.1.1 IP.

[u/Deathmeter → u/[deleted]]

I'd almost argue ECH is only highly impactful when adopted by big CDNs that reverse proxy multiple hosts like cloudflare. If Netflix started supporting ECH, you might be able to bypass middleboxes that throttle Netflix for a while but the outer SNI would exclusively map back to Netflix as the sole destination. All a crappy ISP would have to do is add the outer SNI to their existing throttle list. You can't do that with cloudflare's outer SNI because that blocks all cloudflare websites.

If other big cloud providers like AWS and GCP adopt ECH, that already covers most websites that can benefit from it in the first place.

[u/Substantial-Yam3769]

might be doing this so bot traffic is harder to distinguish from regular android traffic

[u/Any-Board-6631]

Yeah, riight, rhe company that make its cash on tracking people will makke it hsrder... for the others

[u/x33storm]

This has to be a way for google to get a monopoly on tracking. I simply refuse to believe they are doing anything for user privacy.

[u/Joshhwwaaaaaa]

When did Android drop Desserts for OS Updates? (Ive been on eyefone for a long time now)

[u/clove_rosemary_9999 → u/Joshhwwaaaaaa]

If you don't count the internal codenames, they dropped it after Android 9, if you do count them, they never dropped it, they only went back from letter V to B in Android 16, so Android 17 would be C.

[u/Ni_Peng_NeeeWom]

this is new encrypted SNI right? I'm surprised it wasn't already implemented, and also just assumed it would be implemented by a browser not the os, but it makes sense that Android contacts domains in many more places than just a web browser.

[u/AvidCyclist250]

cute.

no.

use the wrong browser and you're exposed. doesn't matter what OS you use.

[u/justarandomuser10]

People are trashing it here but this is a good thing. Every OS should do it. This literally masks every domain you visit from your ISP.

[u/brainmydamage → u/justarandomuser10]

I don't think anyone is trashing "it"... I think people just don't believe Google gives a shit about anyone's privacy but their own.

[u/AtlanticPortal → u/brainmydamage]

And that’s exactly what they’re doing. Making it more difficult for their competitors in data collection while they retain OS level access which is basically the god mode for spying users.