> but it is entirely software based so you can sync credentials between devices. AFAIK one can flash a Yubikey with a specific AES key and make the Yubico back

> but it is entirely software based so you can sync credentials between devices. AFAIK one can flash a Yubikey with a specific AES key and make the Yubico backend aware of that AES key. The OTPs won't start with cccc but something else then (this is used to differentiate from the default flashed AES which is already known by Yubico). So what's stopping you from flashing the same AES key to another Yubikey, essentially duplicating your key (at least for OTP)? This is of course not as secure as the initial AES known by Yubico and present on your Yubikey (not readable).