Beyond ECH, the update addresses weaknesses in legacy cellular signaling. Android 17 introduces protections against IMSI catchers (often called Stingrays) and mitigates other known flaws in the mobile telephony stack that could expose a subscriber’s identity or location. On the home network side, Google is implementing changes that reduce the leakage of device-specific metadata, making it harder for third parties to fingerprint a user's local network environment.

Key details from the announcement:

• ECH support is enabled by default in the OS-level TLS stack, though its effectiveness depends on the destination server also supporting the protocol.
• Cellular hardening includes tamper-resistant mechanisms for subscriber authentication, specifically targeting interception and downgrade attacks.
• Network privacy enhancements limit how apps and remote servers can query local network attributes, closing a vector for cross-device tracking.

These changes are baked into the platform, meaning developers do not need to update their apps to benefit. However, ECH compatibility may vary across CDNs and websites that have not yet implemented the standard on their servers.

Source: Unknown

Are you planning any server-side adjustments to ensure your web services are ECH-compatible before Android 17 devices become widespread in your user base?