Google is out with a blog post today recapping new network security measures in Android 17.
Even with HTTPS connections, the domain names of websites (including apps) are “still visible to network operators and eavesdroppers.”
This unencrypted data can be used to build user profiles or, in the hands of malicious actors, leveraged for targeted phishing and scam campaigns.
Android 17 aims to resolve this with Encrypted Client Hello (ECH). Working with private DNS, this new privacy standard will “obscure the domain names you visit.” This works by hiding the “domain name using a secret encryption key that only the destination website can unscramble.”
By encrypting the destination website name from the very start, ECH helps ensure that, for supported websites and apps, network providers and network snoopers can no longer easily see which websites or apps you are accessing.
With OS support now available, app developers have to upgrade to OkHttp 5.5.0 and enable ECH.
Domain name data leaks in two places, (1) the initial DNS lookup and (2) the unencrypted ClientHello in the Transport Layer Security (TLS) handshake. Recent progress with the rollout of encrypted DNS and the launch of support for Encrypted ClientHello on Android 17 are helping to make online activity more private
On the network front, Android 17 allows mobile carriers to turn off 2G connectivity by default for their users. (Android 12 first introduced this user setting.) This is intended to counter SMS blaster attacks that “force nearby smartphones to drop their LTE or 5G connections and downgrade to less secure, legacy 2G networks.” Phishing texts are then sent to devices.
Meanwhile, Android 17 enforces Local Network Protection wherein apps must now request permission “before they can scan or connect to other devices on your local network.”
For everyday tasks like casting a video to your TV, developers should adopt a secure system tool, which allows you to select your TV without the app ever needing permission to see the other devices in your home.
Finally, Certificate Transparency requires “all certificates to be logged in a public registry, making such an attack much less likely to go unnoticed.”
When you connect to a secure app or website, your device verifies a certificate to confirm the site is authentic. However, if a certificate issuer is compromised, hackers could potentially create fake certificates to intercept your traffic and cause harm.
FTC: We use income earning auto affiliate links. More.
Comments