Two shipping features this week did more for ordinary people’s privacy than most of the month’s enforcement news, and neither required anybody’s permission.

The Hole HTTPS Never Closed

For a decade the standard reassurance has been that HTTPS protects you. It does — it encrypts the contents of what you send and receive.

It has never hidden which site you are contacting. Every TLS connection begins with a Client Hello message, and that message has always carried the destination hostname in plaintext, in a field called Server Name Indication. SNI exists for a mundane reason: one IP address serves thousands of sites, so the server needs to know which certificate to present before encryption is established.

The side effect is that your mobile carrier, your ISP, the coffee shop’s router, and anyone passively watching the network sees a plaintext list of every domain you load, in order, with timestamps. Not the pages. Just the names — which is more than enough to build an advertising profile, infer a medical condition, or target a phishing campaign at someone whose bank you now know.

Encrypted Client Hello fixes it by encrypting that first message using a public key published in DNS. On the wire, an observer now sees only the front-end provider — a CDN like Cloudflare — plus traffic volume and timing.

Browsers have supported ECH for a while. Android 17 makes it platform-wide — the first major mobile operating system to do so — which means it applies to apps, not just the browser. That is the significant part. Most of what a phone does over the network is apps, and apps have never been covered by a browser toggle.

Android 17 also adds Local Network Protection, requiring apps to ask before scanning your home network, and automatic 2G blocking, which shuts down the downgrade attack that cell-site simulators rely on.

What ECH Does Not Do

Be precise about this, because the marketing will not be.

  • It does not hide DNS lookups. If your resolver is unencrypted, the domain leaks there instead. ECH is only complete alongside DNS-over-HTTPS or DNS-over-TLS. On Android, turn on Private DNS.
  • It does not hide your IP address. Your carrier still knows it is you, and still sees which CDN you connected to. It is not a VPN and it is not Tor.
  • It only helps when the destination supports it. ECH requires the site’s provider to publish the keys. Cloudflare-fronted sites largely do; a great many others do not.
  • It does nothing about the trackers inside the page. The Meta Pixel does not care whether your carrier could read the hostname.

What it removes is passive, effortless, network-level surveillance of your browsing — the kind that requires no cooperation from any website and that several countries’ ISPs have monetised openly.

Brave’s Email Aliases

Separately, Brave 1.94 shipped Email Aliases: disposable forwarding addresses you can generate directly from a signup form in the browser, so a site never learns your real address. It is backed by a new Brave Accounts system designed so that account passwords are never transmitted to Brave’s servers.

Apple has offered Hide My Email, Fastmail has masked addresses, and SimpleLogin and addy.io have done this for years. What changes when it is native to the browser at the point of the form is friction — and friction is the only variable that has ever determined whether a privacy feature gets used.

Aliases solve a specific and underrated problem. Your email address is the primary join key of the data broker industry. It is the identifier that lets a breach dump from one company be matched against a marketing list from another, which is exactly the mechanism that makes a set like the 12.9 million genuine Carhartt records valuable long after the breach.

Give every service a different address and the join fails. You also get free attribution: when spam arrives at the alias you gave one retailer, you know precisely who sold or lost it.

Why Client-Side Wins Are Different

This month we have written about a $400 million COPPA settlement, two data broker fines, a federal pricing policy statement, and a California bill removing a private right of action retroactively. All of it matters. All of it is slow, reversible, jurisdictional, and dependent on someone else choosing to act.

A protocol change is none of those things. ECH does not have a compliance date, a carve-out, or a lobbying campaign that can undo it in the next legislative session. It works in every country, including the ones with no privacy law and the ones whose governments were the beneficiaries of the plaintext.

That is also why these features attract objections framed as safety concerns — network-level visibility is what enterprise filtering and some national censorship systems run on. Those are real tradeoffs, and they are the reason ECH took years to ship.

The honest summary is that legal privacy and technical privacy do different jobs. Law can stop collection that technology cannot see, like a company selling data it legitimately holds. Technology can stop collection that law will never reach, like a carrier in a country with no regulator. You need both, and only one of them ships in a point release.

What To Do

  1. Update to Android 17 when it reaches your device and confirm ECH is active. It is on by default where supported.
  2. Turn on Private DNS. Settings → Network & Internet → Private DNS. Use a provider you are willing to trust with the list ECH just took away from your carrier — Cloudflare’s one.one.one.one, Quad9’s dns.quad9.net, or your own. Without this, ECH is half a fix.
  3. Enable ECH in your desktop browser. Firefox has it on with DNS-over-HTTPS enabled; Chrome and Brave support it under Privacy and Security settings.
  4. Start using aliases now, on new signups. Do not try to migrate your whole history. Every new account that gets a unique address is one fewer row that joins to the others.
  5. Give aliases to the highest-risk categories first — retailers, loyalty programmes, newsletters, anything with a “share with our partners” checkbox. Keep your real address for banking, government, and account recovery.
  6. Do not confuse any of this with anonymity. Your IP is still your IP, your logged-in accounts still identify you, and your apps still phone home. These features raise the cost of passive surveillance. They do not defeat a determined, targeted one.