There was a four hour window on Sunday, where if you wanted to sign into somebody’s Dropbox account all you needed was their email address. Type in any password and you were in. The bug appeared after an update to their system. According to Dropbox, once the bug was identified, everyone who was logged into an account was immediately logged out. The company less than 1% of users had their accounts accessed in this way.
Still, this nicely illustrates a kind of tricky situation. Of course, this shouldn’t have happened and if you’re going to run a site like this you should be extremely careful about security considering how much information people store on Dropbox. On the other hand, as long as you have the weak link known as humans running things, are situations like this inherently unavoidable?