We won't know for certain until details are released but their claim that "exploit works even against sites that use HSTS, or HTTP Strict Transport Security" is

We won't know for certain until details are released but their claim that "exploit works even against sites that use HSTS, or HTTP Strict Transport Security" is disturbing.