Problem
Once a user is logged in, viewing/revealing a password does not require a second Duo/2FA challenge. That increases risk if a session is left open, shared, or read by browser/AI tooling that can interact with an already-authenticated page.
Desired behavior
Optional account (or role) setting: “Require step-up MFA to reveal passwords.”
When enabled, revealing a password (and ideally copying the plaintext value) requires a fresh Duo push or TOTP confirmation before the secret is shown.
Why it matters
Adds a practical control against shoulder-surfing, unattended sessions, and automated tools that can click “reveal” on an authenticated browser.
Acceptance criteria
Admin toggle (default off)
Applies to asset passwords and vault passwords
Works on web (mobile if feasible)
Failed/cancelled MFA does not reveal the password
Continue to audit-log successful password views
Reasonable re-auth window optional (e.g. don’t re-prompt every reveal within N minutes)—admin configurable