Ironically, they would never be caught if only they assigned different blobs to the same user on different properties, like KS_cookie XOR hash(property_name).