  Security proofs of quantum key distribution (QKD) typically assume that the
devices of the legitimate users are perfectly shielded from the eavesdropper.
This assumption is, however, very hard to meet in practice, and thus the
security of current QKD implementations is not guaranteed. Here, we fill this
gap by providing a finite-key security analysis for QKD which is valid against
arbitrary information leakage from the state preparation process of the
legitimate users. For this, we extend the techniques introduced in (New J.
Phys. 18, 065008, (2016)) to the finite-key regime, and we evaluate the
security of a leaky decoy-state BB84 protocol with biased basis choice, which
is one of the most implemented QKD schemes today. Our simulation results
demonstrate the practicability of QKD over long distances and within a
reasonable time frame given that the legitimate users' devices are sufficiently
isolated.
