duplicate hsts headers lead to firefox ignoring hsts on business.uber.com

Summary

It was possible for an attacker to temporarily downgrade a chosen victim from a secure HTTPS connection to HTTP in Firefox. The impact of this issue was low due to the very small window that it provided to actually take advantage of the downgrade, and the fact that it required getting a user to click a link. However, this attack did allow an attacker to directly target users for SSL downgrade.

Thank you again for the report, @redshark1802!