P
Previous Gecko
Problem
Once a user is logged in, viewing/revealing a password does not require a second Duo/2FA challenge. That increases risk if a session is left open, shared, or read by browser/AI tooling that can interact with an already-authenticated page.
Desired behavior
Optional account (or role) setting: “Require step-up MFA to reveal passwords.”
When enabled, revealing a password (and ideally copying the plaintext value) requires a fresh Duo push or TOTP confirmation before the secret is shown.
Why it matters
Adds a practical control against shoulder-surfing, unattended sessions, and automated tools that can click “reveal” on an authenticated browser.
Acceptance criteria
  • Admin toggle (default off)
  • Applies to asset passwords and vault passwords
  • Works on web (mobile if feasible)
  • Failed/cancelled MFA does not reveal the password
  • Continue to audit-log successful password views
  • Reasonable re-auth window optional (e.g. don’t re-prompt every reveal within N minutes)—admin configurable