Sen. Ron Wyden (D-Ore.) wants federal websites to stop announcing their names to anyone watching the network, and he has given two agencies a list of 350 addresses that still do.
In a letter to CISA acting director Nick Andersen and deputy federal chief information officer Thomas Flagg, Wyden asked for Encrypted Client Hello (ECH) to be required across federal sites and made a condition for cloud and network vendors seeking federal contracts. He requested an unclassified response and action plan by November 20.
The gap is narrow. HTTPS encrypts pages and forms, but a browser still names the site it wants, in plain text, in a field called Server Name Indication. An internet provider or hostile Wi-Fi network can log a connection to tips.fbi.gov without reading the tip. ECH encrypts that field, and most major browsers have supported it since October 2023, per the letter.
Of the 350 addresses, 191 are diplomatic: 174 embassy sites, three consulates and 14 missions. Another 53 are Bureau of Indian Education subdomains and 12 are test or staging hosts. The other 94 include the DHS inspector general's complaint hotline, the Justice Department's civil rights portal, the State Department's Rewards for Justice site and ICE's detainee locator.
The fixes are not equal. The FBI portal runs on Cloudflare, which supports ECH, so Wyden wrote that it "merely requires a configuration update." The VA's veterans crisis line runs on Amazon Web Services, which the letter says does not support ECH, so the agency would have to switch providers or wait. A contract rule written today would favor a tiny pool of vendors, which works as a market lever as much as a security measure.
ECH also leaves holes. The destination can leak through plaintext DNS lookups or the server's IP address, and agencies cannot make visitors use encrypted DNS. Embassies pose a harder case: Russia has blocked Cloudflare's ECH since November 2024, so enabling it on a Moscow embassy page could make the site unreachable.
Wyden has asked before. In October 2018 he urged DHS to push encrypted DNS and ECH's predecessor, ESNI, on CDN vendors. A 2018 HTTPS letter to the Pentagon did produce a Defense Department plan. Whether this one does may depend on whether Amazon follows Cloudflare.