I’m sorry to hear you are having a poor experience with your third-party token purchase.
When a customer purchases hardware tokens directly from us we are able to import the seed information directly into Duo for the customer. Token vendors will not give us seeds for tokens we did not purchase on behalf of a customer.
There is risk involved with purchasing used or surplus HOTP tokens from a third-party. Even if the university was able to provide you with the secrets for the tokens you purchased, you have no idea how many people have already had access to that information before it got to you. If another copy of the seed info was stored anywhere else, it opens those tokens up for possible 2FA compromise.
When you buy RSA tokens they do send you the seed information for those tokens along with it in an encrypted format. If you lose the seeds you can’t import the tokens into RSA either.
Yubikey tokens are programmable, so they don’t rely on a static token seed info. We do recommend Yubikey tokens to customers who want to manage the token secrets themselves.
