Cameron and Tyler Winklevoss arrive at the White House Correspondents Association Dinner on May 3, 2014 in Washington, DC. Rena Schild/Shutterstock
The Winklevoss twins’ Gemini exchange has bolstered its security capabilities with the addition of hardware key compatibility on iOS and Android mobile devices, the firm said in a blog post on 14 July.
According to the announcement, Gemini has become the first cryptocurrency exchange to introduce support for hardware security keys for its mobile application, which will allow its users to authenticate their accounts through a cryptographic proof of a user’s identity. The new feature will ensure that only the holder of the physical key has access to an associated account, even if the password to that account has been compromised by an attacker, or if a SIM-swap attack has been executed successfully.
Gemini’s Chief Security Officer, Dave Damato, said in the blog post:
“Gemini customers can now use USB and near-field communication (NFC) security keys to securely sign into the Gemini Mobile App. Hardware security keys provide the strongest level of protection when authenticating to your Gemini account by delivering hardware-backed, cryptographic proof of your identity.”
Gemini’s new security capabilities come as part of a new partnership with Yubico, which provides a secure, cross-platform solution in the face of Yubikey. The extra feature will be an addition to Gemini’s current security layers, which include TouchID and Windows Hello. In order for users to take full advantage of the new feature, they will have to register at least two hardware keys, one of which should be supported by their mobile devices.
Ordinary two-factor authenticators, when enabled, require a single-use code, usually provided via a text message or a third-party app, in addition to the simple website login password. The new Gemini feature is also a form of two-factor authentication, but one where a physical device is required to be pluged-in, such as Yubico’s Yubikey, in order to access an account.
Although the Web Authentication (WebAuthn) internet standard was introduced to Gemini’s mobile app on Tuesday, its main browser-based platform had been supporting it since May 2019.