US Senator Ron Wyden says 350 federal web addresses using content delivery networks do not enable Encrypted Client Hello (ECH), a feature that hides the requested website’s hostname during part of a secure connection.
In a letter to the acting director of the Cybersecurity and Infrastructure Security Agency (CISA) and the deputy federal chief information officer, Wyden asked the agencies to require ECH on federal websites and make vendor support for it a condition of federal contracts. He requested an unclassified response and action plan by November 20, 2026.
The list attached to the letter includes the FBI’s tips.fbi.gov portal, which uses Cloudflare but has not enabled ECH, and the Department of Veterans Affairs’ veteranscrisisline.net service, hosted by Amazon Web Services. The letter says Amazon’s service does not currently support ECH. Wyden says enabling the feature on Cloudflare requires a configuration change.
Of the 350 addresses, 191 are diplomatic sites, 53 are subdomains of the Bureau of Indian Education’s bie.edu domain, and 12 are test, training or staging hosts. The remaining 94 include government complaint and reporting portals, health information sites and ICE’s detainee locator.
ECH can conceal a hostname from observers on a network, but plaintext DNS lookups or a server’s IP address can still reveal the destination. The article also notes that Russia has blocked Cloudflare’s ECH since November 2024, which can make protected sites unreachable there.
Comments
0No comments yet. Be the first to comment.