Android 17 Beta Strengthens Secure-by-Default Design for Privacy and App Security

Google announced the first beta version of Android 17, which includes several privacy and security enhancements.

Android developers have described several improvements related to performance, media and camera apps, connectivity, and developer productivity.

In terms of security and privacy, they unveiled two major changes: deprecation of a cleartext attribute, and introduction of a public Service Provider Interface (SPI) for HPKE hybrid cryptography.

The first, which aims to reduce risks associated with unencrypted traffic, is related to the usesCleartextTraffic attribute. On apps targeting Android 17, if the attribute is set to ‘true’ but lacks a corresponding network security configuration, cleartext traffic will be blocked by default.

Developers are advised to migrate to network security configuration files for more granular control.

The introduction of support for HPKE via a new SPI enables developers to implement secure hybrid encryption combining public-key and symmetric (AEAD) mechanisms. The goal is to facilitate stronger, more efficient ...