Senator Urges Federal Agencies to Hide Visitor Site Names From Network Snoops
Sen. Ron Wyden says hundreds of federal web addresses, including an FBI tip portal and a VA crisis line, still reveal which sites visitors are reaching.
According to TechRadar, Sen. Ron Wyden (D-Ore.) is calling on the federal government to turn on a privacy feature called Encrypted Client Hello, which major web browsers have supported for about three years. He wants the Cybersecurity and Infrastructure Security Agency and the Office of Management and Budget to require the feature on federal websites and to make it a condition of federal contracts.
The report says Wyden compiled a list of 350 web addresses hosted on content delivery networks that do not use the feature. Those addresses still broadcast the name of the site a visitor is trying to reach, which can be seen by anyone positioned along the network path, even when the page content itself is encrypted. According to the report, the list includes the FBI's tip portal, the Department of Veterans Affairs crisis line, and hotlines for whistleblowers and civil rights complaints.
TechRadar also reports several limits on the technology. The feature hides site names only when it is paired with encrypted DNS, the system that translates web addresses into server locations. It does nothing to protect data if a server itself is breached. The report adds that the feature is already blocked in Russia, and that some of the listed addresses are embassy pages.
The source material does not describe any response from the agencies named in the letter or the list. It also does not say whether a deadline or timeline for changes has been proposed.
Background
Every time a browser connects to a secure website, it sends an initial message to set up encryption. In most cases, that first message includes the site's name in plain text, a field known as Server Name Indication. Because the field is visible, anyone who can watch the connection, such as an internet provider, a network administrator, or someone on a shared public network, can often tell which site a person is visiting, even if they cannot read the pages.
Encrypted Client Hello is a newer standard designed to encrypt that opening message. The browser and server use keys published through the domain name system, so the site name stays hidden from observers on the path. Full protection generally requires encrypted DNS as well, because otherwise the lookup for the site's address can reveal the same information.
Content delivery networks complicate the picture. These services host many customers' sites on shared infrastructure, so a single network can serve thousands of unrelated domains. Adoption depends on both the hosting provider and the website operator enabling the feature, which is one reason federal sites that rely on these networks can lag behind.
Federal web policy is shaped largely by CISA, which advises agencies on cybersecurity, and by OMB, which issues government-wide technology and security directives. Procurement rules can also require vendors to meet specific standards, which is the lever Wyden's proposal would use.
Why it matters
The issue is less about whether any single page is secret and more about what a connection reveals. Knowing that someone reached a tip line, a crisis hotline, or a complaint portal can say a great deal about that person's situation, even without any message content. For people seeking help or reporting wrongdoing, that exposure can discourage them from reaching out at all.
The proposal also highlights a gap between what browsers can do and what websites actually do. Browsers have already shipped support, so the remaining work sits with the organizations running servers and hosting. Federal agencies are large, slow-moving customers, and a directive that ties the feature to contracts could push vendors and agencies to move together.
At the same time, the limits matter for public expectations. A feature that hides site names does not stop server breaches, malware, or phishing, and it can be blocked by governments that want to restrict access. Clear communication will matter if agencies adopt it, so people understand what protection they gain and what they still need to watch for.
What to watch
The first signal will be whether CISA or OMB responds to the request, either by issuing guidance or by naming a timeline for federal sites. Any formal directive would indicate how seriously the government treats visitor privacy on its own services.
Next, watch which of the listed addresses change. Public tracking of the 350 addresses, if it happens, would show whether agencies and their hosting providers can act quickly. Changes to the crisis and tip lines would draw particular attention.
Finally, keep an eye on the technical side. Adoption of encrypted DNS across federal networks, and any issues reported with content delivery networks, will determine how much protection the change actually delivers.
Viewpoints
Commentary from our columns: three angles on this story.
The Rulebook privacy, safety and regulation
Privacy protections often fail in the gaps nobody checks, and this story is a clear example. A government website can be secured on the page itself and still leak the fact that someone visited it. For a person contacting a veterans crisis line or an FBI tip portal, that metadata can matter as much as the message.
The regulatory question is who holds the lever. Wyden's request points to two obvious ones: CISA guidance and OMB directives. Tying the feature to federal contracts would reach beyond the agencies themselves and push vendors to comply. That approach has precedent in other security rules, and it avoids waiting for every agency to act on its own.
Regulation should still be specific. A rule that says "enable this feature" is easy to satisfy on paper while leaving encrypted DNS, server hygiene and hosting configurations untouched. Good policy would name the full set of protections and ask agencies to report where they stand, publicly and on a schedule.
The Skeptic open questions and weak points
The headline number is striking, but it raises questions the report does not fully answer. How many of the 350 addresses are truly sensitive, and how many are ordinary public information pages? A list of hosts without a feature is not the same as a list of harms, and the difference matters when deciding how urgent the fix is.
The limits are equally important. The feature only helps when paired with encrypted DNS, does not protect a server that has been breached, and is already blocked in some countries. Anyone reading this as complete protection for federal visitors would be mistaken. Officials should be careful not to let a single checkbox stand in for a broader privacy program.
There is also a practical question about what happens next. The source material does not show any agency reply, timeline or cost estimate. Until those appear, the request remains a request. It is worth asking whether the proposal includes a way to verify compliance, or whether success will be measured by press releases alone.
The User what changes for people who use it
For most people, the change would be invisible. You would type the same address, see the same page and get the same service. The difference would be that someone watching your connection on a shared network would see less about where you were headed, which is a meaningful gain when the destination is a help line.
That is the part worth remembering. People often reach these services at moments of stress, sometimes from a work computer, a library or a shared home network. Knowing that the site name is less exposed could make someone more willing to call or submit a report, and that is a practical benefit, not an abstract one.
Still, users should not assume safety from a single setting. Check that the site uses a secure connection, be cautious with links that arrive by email or text, and use official addresses listed by the agency itself. The feature protects part of the connection, and good habits protect the rest.