Which is a trade-off of passwordless authentication in MIPC?

• A. Improved user experience but requires secure enrollment.
• B. Lower security risk.
• C. Incompatible with mobile apps.
• D. Always requires physical tokens.

Answer: (A)

Passwordless authentication improves the login experience by removing passwords and relying on factors like biometric verification, device-bound credentials, or security keys. The essential trade-off is that the enrollment process—the initial setup where you prove your identity and register the authenticator—must be highly secure. If enrollment is weak or compromised, an attacker could register a fraudulent device or credential, enabling unauthorized access despite the absence of a password. So the smoother experience comes with the responsibility of making enrollment rock-solid.

The idea that security is automatically lower isn’t guaranteed; security can be strong with passwordless methods, but only when enrollment and implementation are solid. It isn’t inherently incompatible with mobile apps, since many passwordless flows work on mobile devices via WebAuthn or platform authenticators. And it doesn’t always require a physical token, because biometrics or built-in device credentials can serve as the passwordless factor.