Well. Not to defend LP, but for those who don't click through, offline mode can (and should be?) disabled.

Perhaps this is a case where a feature that makes some sense in some cases was added, the problem is, outside that scope it's a really bad idea. But then someone said "We'll make it optional..." and the rest was history?

This isn't a bug, this is due to the offline access option. If your machine has the database locally cached, 2FA won't do anything because your database won't be encrypted with 2FA (not possible), just your master password. An attacker could just copy the cached database and decrypt it with your master password. All 2FA does is restrict who can download your database (both initial and updates), not decrypt it. If you don't like this behavior, disable offline mode.

This is just fear mongering.

This "second" became very noticeable to me once I moved to Sydney. I was actually able to log in to my Gmail before my 2FA kicked in. Right then I decided that, despite being a loyal LastPass user for the last 10+ years, it was time to try something else.

I would prefer a tool that works for teams if anyone has suggestions. I care about how my team manages and shares their passwords. Looking for something that works across devices, and where I can share access but not necessarily share the actual passwords if I can avoid it. I really like LastPass, it's a shame about some of their issues.

Writing good security software is difficult, but that doesn't stop places who really shouldn't be doing it from trying and succeeding in a business sense. https://thycotic.com/products/secret-server/ passes JSON in URLs, and we're not even talking base64 here. Also, it's called "thycotic" like you're holding your tongue and saying "psychotic". There are more problems that I won't go into.