  Recently there were many proposals on device-independent (DI) quantum key
distribution protocol whose security is based on the violation of the
Clauser-Horne-Shimony-Holt inequality. However, as a statistical law, a certain
extent of fluctuation has to be allowed. We show that the eavesdropper can make
use of this property to obtain a remarkable part of the secret key by replacing
some of the DI nonlocal boxes with local ones. On the contrary, the same
cheating strategy does not apply to the device-dependent (DD) version of the
protocol. Thus such kind of DI protocol is less secure than its DD counterpart.
