Boffins find quantum cryptography loophole