  Weak coin flipping is among the fundamental cryptographic primitives which
ensure the security of modern communication networks. It allows two mistrustful
parties to remotely agree on a random bit when they favor opposite outcomes.
Unlike other two-party computations, one can achieve information-theoretic
security using quantum mechanics only: both parties are prevented from biasing
the flip with probability higher than $1/2+\epsilon$, where $\epsilon$ is
arbitrarily low. Classically, the dishonest party can always cheat with
probability $1$ unless computational assumptions are used. Despite its
importance, no physical implementation has been proposed for quantum weak coin
flipping. Here, we present a practical protocol that requires a single photon
and linear optics only. We show that it is fair and balanced even when
threshold single-photon detectors are used, and reaches a bias as low as
$\epsilon=1/\sqrt{2}-1/2\approx 0.207$. We further show that the protocol may
display quantum advantage over a few hundred meters with state-of-the-art
technology.
