They require the user to blink to protect against this sort of attack but there are workarounds.