Android 17 closes the SNI leak but people are already overselling what it fixes

Saw the news that Google's rolling ECH (Encrypted Client Hello) support into Android 17. Wanted to drop a plain language explanation because the headlines are making this sound bigger than it is.

Backstory for anyone who hasn't run into this when your phone connects to a website over HTTPS there's a handshake step where it basically announces the domain name in plaintext even if your DNS queries are encrypted. That means your ISP could always reconstruct a list of every site you visited just by watching that handshake DoH/DoT or not. Most people had no idea that gap even existed.

ECH encrypts that part too, so the domain name stops leaking during the handshake. Genuinely good move and it's now a real standard (RFC 9849) not some experimental Chrome flag.

but here's the catch nobody's mentioning in the excited posts:

– It only works if the website you're visiting also supports ECH. Right now that's a small slice of the web. Server side adoption is historically slow, so don't expect this to matter for most sites anytime soon.

– Your IP address is completely untouched by this. ISPs can still map which servers you're talking to and third party sites still see your actual IP for tracking and geolocation.

So this patches one specific leak (domain names during the TLS handshake) not the whole surveillance picture. If your goal is my ISP sees nothing but an encrypted blob or sites can't tie sessions back to my real IP you're still looking at a VPN for that.

Not knocking the update it's a legit privacy improvement just don't want people to think this makes VPNs redundant because it doesn't touch the IP problem at all. Anyone here on the Android 17 beta already able to confirm ECH is on by default?