Today, Gemini is excited to become the first crypto exchange to introduce support for hardware security keys across both Android and iOS mobile devices via WebAuthn. Gemini customers can now use USB and near-field communication (NFC) security keys to securely sign into the Gemini Mobile App. 

Hardware security keys provide __the strongest level of protection when authenticating to your Gemini account__ by delivering hardware-backed, cryptographic proof of your identity. They ensure that only the holder of the physical hardware key can gain access to an associated account, even if an attacker has compromised your password or successfully executed a SIM-swap attack on your mobile device. This mitigates the risk posed by phishing, person-in-the-middle, and replay attacks that rely on stolen passwords or one-time password (OTP) codes.

To help our customers take advantage of this new offering, we have partnered with [Yubico](https://www.yubico.com) — maker of the popular hardware security key, YubiKey. Along with existing platform authenticators (e.g. TouchID and Windows Hello), YubiKeys provide a secure, cross-platform solution you can use to access your Gemini account via our Mobile App, as well as any other sites that support WebAuthn. You can learn more about our partnership with Yubico on the [Works With YubiKey](https://www.yubico.com/works-with-yubikey/catalog/gemini/) web page. 

In order to exclusively rely on hardware security keys and disable Authy/SMS based  authentication, you will need to register at least two hardware keys, including one supported by your mobile device. This could include a platform security key such as MacOS [TouchID](https://support.apple.com/en-us/HT207054) or [Windows Hello](https://support.microsoft.com/en-us/help/4028017/windows-learn-about-windows-hello-and-set-it-up) and a cross-platform hardware security key such as a YubiKey. To learn more about selecting and using the right security keys to access your account, refer to Gemini’s [support documentation](https://support.gemini.com/hc/articles/360044275792) and [instructional video](https://www.youtube.com/watch?v=NB2-CE6wgeE). 

Our security and engineering teams continue to prioritize new security features in order to provide the best and most secure user experience possible. We look forward to sharing more exciting security-focused announcements in the coming months. Come [join us](https://gemini.com/careers) if you’re passionate about cryptocurrency and blockchain-related security challenges. 

Onward and Upward,

Dave Damato, Chief Security Officer


Gemini Becomes First Crypto Exchange to Support Hardware Security Keys on Mobile App

Gemini’s security team proactively monitors for illegitimate websites that pose a risk to our customers. If you know what to look for these sites are often easy to identify. Based on our experience we wanted to share some security best practices that can help you quickly spot risky websites and associated scams.


# The Basics of Identifying Fraudulent or Malicious Websites
Many fraudulent or malicious websites rely on impersonating a trusted website. This is typically done through the manipulation of URLs and hyperlinks. 

__Go Direct.__
The easiest way to avoid an untrustworthy website is to avoid clicking on a link and instead go to a trusted website through a search engine or by typing the URL directly into the browser. 

__Check the Address.__
Sometimes it’s not easy to browse directly to a website and we need to click a hyperlink. To reveal the URL that a hyperlink references, on your desktop computer, simply move your mouse over the link (don’t click it).  For Chrome and Firefox, the full URL for the link will appear in the bottom left of the browser. 

__Uncover Shortened and Unknown URLs.__
Any URL can redirect you to another location. When you see a shortened URL that you may suspect is malicious or a URL that is unknown, you’ll need to use a site like [URLscan.io](https://urlscan.io) to help reveal the true URL.¹

![google.com](//images.ctfassets.net/jg6lo9a2ukvr/gvvroMxZWhEzIjN05lftl/ea99a6fad492d24a4d9d700b22a91765/google.com.png)

Once you have the true URL, you’ll need to determine if it’s a legitimate site. In most cases it should be apparent. 

__Examine URLs Closely.__
There are some techniques that can be used to trick users into thinking a URL is trustworthy, when in fact it is not. Internationalized Domain Name (IDN) homography attacks use look-alike characters to trick users into believing they are accessing the correct URL. Examples include replacing the letter “O” with a zero or the letter “I” with the number one. Chrome and Safari resolve these deceptions when you move your mouse over a link, making them easy to spot. Firefox by default does not — although it is [configurable](https://developer.mozilla.org/en-US/docs/Mozilla/Internationalized_domain_names_support_in_Mozilla). 


# Advanced Tactics for Identifying Fraudulent or Malicious Websites
If, after all these steps, you’re still not sure a site is trustworthy, you should probably avoid it. However, if that’s not an option and you’re determined to proceed, there are more steps you can take to determine a website’s trustworthiness. 

__Assess Observed Malicious Activity.__
Using a scoring system, sites like [[URLscan.io]](https://urlscan.io/) take into account different data sources and page characteristics to determine the likelihood a site is malicious. Below is an example from URLscan.io of a warning displayed for a known phishing site. 

![url.io](//images.ctfassets.net/jg6lo9a2ukvr/2Ibfs8ktmWyniKvDaCZmE3/54536e9d588f86a0f1356a02ff4ca390/url.io.png)

__Validate Certificate Information.__
Today, most websites utilize Transport Layer Security (TLS) and underlying certificates. These certificates contain valuable information that can be used to gain a better understanding about a website. 

There are three types of certificates: 
- __Domain Validated (DV):__ cheap and easily obtainable
- __Organization Validated (OV):__ require a registrar to verify a company’s identity, providing an additional level of assurance
- __Extended Validation (EV):__ most difficult and expensive to obtain, providing the highest level of assurance 

A DV certificate contains no identifying information in the organization name field; instead it will typically just repeat the domain name. An OV certificate will include the name of the organization and an EV certificate will contain the name of the organization and the physical address. To check if a site uses an EV certificate, you can use SSL Labs.

![certificate](//images.ctfassets.net/jg6lo9a2ukvr/3V3BZE88rG03chNmo4IAQy/30d8fec526d4b2adabc4ac4ed2c01705/certificate.png)

Certificates are strong indicators, but not a guarantee, of a site’s relative trustworthiness.

__Check the Domain Registration Date.__
Malicious actors tend to create a domain just before use. As a result, if a domain is fairly new, it has a substantially higher chance of being malicious. Legitimate sites don’t often register a domain and then launch an e-commerce site in weeks. Although there will always be exceptions, domain registration date is another piece of information that can be used to determine potential scams or malicious sites. 

__Preview the Website.__
Although visiting an untrustworthy site can be risky, viewing a picture of the site won’t cause harm to your computer or result in the loss of personal information. Services like URLscan.io remotely view and capture an image of the site you’ve requested allowing you to take a peek at the site without taking the risk of actually visiting the site itself. With an image, you can assess the site for pixelated images, poor grammar, sloppy design, or other telltale signs of an untrustworthy site. If it looks unprofessional it’s likely not legitimate. 

# Preparing for Failure
Eventually everyone clicks on a link or visits a website that contains malicious content. The good news is that when properly used, most modern web browsers and accompanying extensions can act as a security boundary. 

__Update Your Browser.__
Modern browsers are very secure if they’re up-to-date and conveniently most now auto-update by default. But, in order to complete an update, you need to restart your browser periodically.  Keeping your browser up-to-date, avoids most problems. 

__Block Malicious Content.__
Malicious content in websites can be hosted in ad networks and/or be present in active website content. There are a number of third-party extensions for major browsers that block or reduce the amount of ads and active content rendered when visiting a website. uBlock origin is a popular ad-blocking extension that is easy to operate and has minimal impact on normal browsing. Although more difficult to use, NoScript is an example of a popular and highly effective extension that blocks active content. 

__Use a Password Manager.__
In addition to all of their traditional benefits, password managers also only fill out account details on saved sites. So, if you visit a phishing site that is attempting to steal your credentials, the password manager won’t automatically populate your credentials and in some cases may even provide a warning. 

# Arming You With Knowledge to Protect Yourself
Fraudulent and malicious websites cost consumers hundreds of millions of dollars every year. Hopefully these security best practices will help you to identify and avoid malicious websites.
Read our [Common Online Scams and How to Avoid Them](https://gemini.com/blog/common-online-scams-and-how-to-avoid-them) post to further help you protect yourself and always remember to use caution and good judgement online. Stay safe out there.


Onward and Upward,

Dave Damato, Chief Security Officer 




-----------------
¹ Limit URLs submitted to third parties to those you suspect are malicious. Legitimate URLs that reference sensitive information could be viewable by a third party. 


David Damato

ARTICLES BY David Damato

Gemini Becomes First Crypto Exchange to Support Hardware Security Keys on Mobile App

Detecting Fraudulent or Malicious Websites

A simple, secure way to buy and sell cryptocurrency