How would any company, regardless of geography have the secret I generated? This is a stand alone hardware device. They seller is not involved at all once I’ve received my package.
Could a sophisticated/well resourced actor clone the smart card they stole or you lost? Sure, brute force attacks are brute force attacks. At least you’d know your device and card are stolen. Now you’re in a race to reset your passwords before they finish making 500 clones of the smart card they stole.
Hypothetically I could blackmail someone at LastPass and have a backdoor is installed for me.
Someone could bust down my door while I have it connected and unlocked and just login to all my things. ¯\_(ツ)_/¯
I saw the lack of arm and facepalmed but I was half asleep poo posting so got over it :p (fixed now!)
I’ve been using this device for ~5 years now, so my memory is a little hazy on it, but I’m pretty sure for the particular device I prefer (which is to say, I have nfc what the setup is for other vendors, which could be greatly superior) the AES-256 key used for encryption isn’t generated until you setup your first card.