Wyden warns 350 federal websites expose visitors without ECH
Sen. Ron Wyden says 350 federal web addresses still reveal their hostnames to network observers and wants agencies to adopt Encrypted Client Hello.
A US senator is warning that 350 federal web addresses still expose the names of the sites people visit to anyone watching the connection, even when the pages themselves use HTTPS. The list includes the FBI’s tip portal, the Veterans Affairs crisis line, whistleblower services and civil-rights complaint pages. 1
Sen. Ron Wyden has asked the Cybersecurity and Infrastructure Security Agency (CISA) and the Office of Management and Budget (OMB) to require Encrypted Client Hello (ECH) on federal websites, and to make support for the privacy feature a condition of future cloud and network contracts. His letter requests an unclassified response and action plan by November 20, 2026. 2
What ECH actually hides
HTTPS protects the contents of a connection: the pages, forms and messages exchanged after a secure session begins. It does not automatically hide the hostname requested at the start. A browser traditionally sends that name through Server Name Indication (SNI), allowing an internet provider, hostile Wi-Fi network or compromised carrier to see that someone connected to tips.fbi.gov even if it cannot read the tip itself. 1
ECH encrypts that part of the TLS handshake. When it is configured properly alongside encrypted DNS, an observer should see a connection to a shared provider front door rather than the specific site being visited. Cloudflare describes the feature as a way to conceal the destination name from passive network observers while retaining the provider’s ability to route the request. 3
That distinction matters for federal services. Knowing that a person visited a suicide-prevention line, an immigration tip form or a civil-rights portal can reveal sensitive information without an attacker needing to break into the site. ECH does not make the user anonymous, but it removes one useful piece of metadata from the network path.
The federal sites on Wyden’s list
Wyden’s letter identifies 350 executive-branch addresses that use content-delivery networks without ECH. The list is broad: 191 addresses are diplomatic sites, 53 are Bureau of Indian Education subdomains and 12 are test, training or staging hosts. The remaining 94 include the FBI tip portal, the Veterans Crisis Line, a Department of Homeland Security inspector-general hotline, a Justice Department civil-rights reporting portal, a USCIS tip form, public-health services and other sites where the hostname can itself be revealing. 1
The technical remedies are not identical. Cloudflare supports ECH, and Wyden says the FBI could enable it through a configuration change. The Veterans Crisis Line is hosted on Amazon Web Services, which the letter says does not currently offer the same support in the relevant setup. That could force a provider change or leave the agency waiting for the infrastructure to catch up. 1
There is also a practical complication for international users. Several listed addresses belong to US embassies and missions in countries where Cloudflare services or ECH traffic may be blocked. Hiding a hostname is valuable, but not if the privacy measure makes a service unreachable for the people it is meant to serve.
ECH is useful, not magic
ECH closes a real leak, but it does not conceal every clue. The destination can still be inferred from plaintext DNS, the server’s IP address or other traffic patterns if the user’s DNS and network path are not protected. Browser support is no longer the main obstacle: major browsers have supported ECH for years, and Android 17 added system-wide support, according to the reporting behind Wyden’s letter. 1
That puts more responsibility on site operators and infrastructure providers. A federal agency can configure ECH on a Cloudflare-hosted domain, but it cannot force every home connection to use encrypted DNS. The result is a meaningful reduction in passive snooping rather than a complete privacy shield.
Our opinion
Wyden’s request is technically modest and politically useful. Turning on ECH where a provider already supports it should be routine for a federal service, especially when the visible hostname can identify a crisis line or a confidential reporting channel. The harder cases expose a procurement problem: if one major provider supports the feature and another does not, a new contract rule could improve privacy while narrowing the government’s practical choice of infrastructure.
The sensible approach is a measured one. Federal agencies should publish which services support ECH, fix the easy Cloudflare configurations first and set a deadline for providers that cannot yet deliver it. They should also pair ECH with encrypted DNS guidance and clear fallback plans for embassy users. The feature will not make federal browsing invisible, but leaving sensitive hostnames exposed when the fix is available is increasingly difficult to defend.