Are at-rest profiles (without rebooting, after "end session") safe from this attack?