Skip to main content

Require Duo/2FA again before revealing a password

Core Web AppSecurity & credentials

Problem

Once a user is logged in, viewing/revealing a password does not require a second Duo/2FA challenge. That increases risk if a session is left open, shared, or read by browser/AI tooling that can interact with an already-authenticated page.

Desired behavior

Optional account (or role) setting: “Require step-up MFA to reveal passwords.”

When enabled, revealing a password (and ideally copying the plaintext value) requires a fresh Duo push or TOTP confirmation before the secret is shown.

Why it matters

Adds a practical control against shoulder-surfing, unattended sessions, and automated tools that can click “reveal” on an authenticated browser.

Acceptance criteria

  • Admin toggle (default off)

  • Applies to asset passwords and vault passwords

  • Works on web (mobile if feasible)

  • Failed/cancelled MFA does not reveal the password

  • Continue to audit-log successful password views

  • Reasonable re-auth window optional (e.g. don’t re-prompt every reveal within N minutes)—admin configurable

1 comment

Log in to comment and vote

Comments1

  • Copper Corn

    •

    Sep 24

    •

    Merged request

    require 2FA re-authentication before revealing a password

    It would be great to have the option to require a fresh 2FA challenge every time a user tries to reveal a password, not only at login. Right now, once a session is authenticated, any password in scope can be viewed without any further check. This means that if a session token or an unlocked device gets compromised, an attacker gets silent access to every password the user can see, with no second factor standing in the way.

    The idea is to add a setting, configurable by admins, that triggers a step up authentication prompt specifically on the reveal action for passwords (and ideally OTP reveals too). This should work regardless of which 2FA method the organization has configured, whether it is Hudu's native app based 2FA or an integrated method like Duo Push. So a user would log in normally, browse freely, but the moment they click reveal on a password, they get an extra native 2FA code request or a Duo push notification, and only after approving that would the plaintext value actually be shown.

    This would give admins the option to treat password reveals as a higher sensitivity action than general navigation, similar to how some other platforms already handle step up authentication for sensitive operations. It would also pair well with the existing SSO with MFA request already open on this board, since it addresses the same underlying concern, meaning that authentication used to enter the system should not automatically be enough to unlock the most sensitive content inside it.