Wyden: "I write to urge the Cybersecurity and Infrastructure Security Agency (CISA) and the Office of Management and Budget (OMB) to protect web browsing information from surveillance by hackers and foreign adversaries. Specifically, your agencies should require that federal agencies and technology vendors adopt Encrypted Client Hello, an important encryption technology that protects information about websites that Americans visit.
Government websites nearly universally encrypt website data, protecting the contents of web pages from prying eyes. However, standard web encryption does not protect website names such as “reportfraud.ftc.gov.” As data travels across the internet, hackers and foreign actors monitoring network connections can easily see these exposed website names. This visibility could lead to malicious eavesdroppers identifying whistleblowers, profiling cleared federal personnel, tracking Americans seeking crisis support, and mapping interactions between agencies.
Encrypted Client Hello (ECH) is a cybersecurity technology that protects the name of the website visited by a user. It is particularly effective when used by major Content Delivery Networks (CDNs), which connect hundreds of thousands of different websites to the internet. When ECH is used on a website delivered by a CDN, anyone intercepting a user's web traffic can see which network is delivering the content, but cannot directly identify the specific site visited among the many websites hosted on the same CDN."
https://www.wyden.senate.gov/imo/media/doc/10192026lettertocisaandomb.pdf (pdf)