3 ms·

I've seen this done in the wild. It's possible to defeat, but only if users are vigilant. Which not all are.