I do not want to hate on them but they did have a pretty massive oversight of ... not checking that any of their traffic was encrypted or authenticated.

https://news.ycombinator.com/item?id=49817524