Can 2FA keys be duplicated?

Question

I want to order a 2FA key (like yubikey) online and I want to know if someone could make a duplicate of whatever key I order during shipping. I don't want to discuss if someone could access my package. I want to know if someone is able to access my package during shipping or even after I get it, could they make a duplicate of my key?

And if they can, and they also have my password, that means they can also access my account (Gmail) after I setup the 2FA authentication right? What about locking me out of my account?

And can you tell me what key would be compatible with multiple online accounts and preferably offline use on Linux (Ubuntu) as well?

Answer 1

When you setup a new hardware token, you're usually presented with one of two options: you can either let the token generate a new key or you can program it with a key you generated outside the token.

By design, keys that are stored by a 2FA token cannot be read out of the token. That doesn't mean that in the future, someone can't find a vulnerability in the design that makes this possible.

However, if someone has a physical access to your token before they reach you, there's a much easier attack vector rather than tampering with the token, which is to simply swap the hardware token itself with a fake one that is designed to send the keys out to the attacker.