Attacker is after everyone. As shown in case 3, attacker should loose... but there is a hole in browserId!