Enable SMS code notification for enrollment and verification
The password_reset.sms.use_notify property controls the usage of SMS code notifications for password reset.
The password_reset.sms.use_notify system property controls usage SMS code notification for enrollment and verification. If password_reset.sms.use_notify is set to the recommended value true, then user isn't notified for password reset for SMS verification method and new device enrollment. Using SMS code notification for enrollment and verification is more secure that default email notification.
Ensure the property password_reset.sms.use_notify is set to true.
More information
| Attribute | Description |
|---|---|
| Configuration name | password_reset.sms.use_notify |
| Configuration type | System Properties \(/sys\_properties\_list.do\) |
| Data type | Boolean |
| Recommended value | true |
| Default value | <none> |
| Fallback value | true |
| Category | Authentication |
| Security risk | - Severity score: 3.7 - CVSS rating: Low - Security risk details: Email-based notifications are generally less secure because they are more susceptible to account compromise and phishing attacks. Using SMS for verification provides stronger assurance of user identity and reduces the risk of unauthorized password resets or fraudulent device enrollments. |
| Functional impact | None |
| Dependencies and prerequisites | None |
Parent Topic:Authentication