  Deauthentication is an important component of any authentication system. The
widespread use of computing devices in daily life has underscored the need for
zero-effort deauthentication schemes. However, the quest for eliminating user
effort may lead to hidden security flaws in the authentication schemes. As a
case in point, we investigate a prominent zero-effort deauthentication scheme,
called ZEBRA, which provides an interesting and a useful solution to a
difficult problem as demonstrated in the original paper. We identify a subtle
incorrect assumption in its adversary model that leads to a fundamental design
flaw. We exploit this to break the scheme with a class of attacks that are much
easier for a human to perform in a realistic adversary model, compared to the
na\"ive attacks studied in the ZEBRA paper. For example, one of our main
attacks, where the human attacker has to opportunistically mimic only the
victim's keyboard typing activity at a nearby terminal, is significantly more
successful compared to the na\"ive attack that requires mimicking keyboard and
mouse activities as well as keyboard-mouse movements. Further, by understanding
the design flaws in ZEBRA as cases of tainted input, we show that we can draw
on well-understood design principles to improve ZEBRA's security.
