  Detector-device-independent quantum key distribution (ddiQKD) held the
promise of being robust to detector side-channels, a major security loophole in
QKD implementations. In contrast to what has been claimed, however, we
demonstrate that the security of ddiQKD is not based on post-selected
entanglement, and we introduce various eavesdropping strategies that show that
ddiQKD is in fact insecure against detector side-channel attacks as well as
against other attacks that exploit device's imperfections of the receiver. Our
attacks are valid even when the QKD apparatuses are built by the legitimate
users of the system themselves, and thus free of malicious modifications, which
is a key assumption in ddiQKD.
