When a MFA (time based) device security key drifts out of synchronization there is a procedure to resynchronize it. But there is no input to the device itself.
Smartphone apps don't have this problem. I assume this is because the app has access to the accurate clock from the telco provider(s). Security key devices need to have their own clock or source of time, which can be attacked (receive it over a radio signal such as WWV or CHU in North America), or drift (internal clock). I am guessing all the devices I have seen use an internal clock, because there many reports of them needing to be resynchronized, often. But it is not obvious how this is done so quickly, or done in places with no clock sources. It is also not obvious why an administrative setting is needed to resynchronize the device.
Can someone explain (or provide a good link that explains) how the device gets resynchonized? I want to understand the degree of risk this might have.