I think that part of what's going on is that savvy users have become wary of trusting companies to securely manage their data. I first started reading Slashdot

I think that part of what's going on is that savvy users have become wary of trusting companies to securely manage their data. I first started reading Slashdot shortly after they launched; that was almost 15 years ago. It wasn't long after their launch that they started running articles on technology companies doing bad or stupid things with users' data, and there have been so many examples on so many forums in the intervening years that, to be honest, I'm literally disgusted every time another one comes around. Trusting companies to, for example, only give access to our data when forced to by law just doesn't cut it anymore, for a lot of people. Not when companies collectively have a very poor track record in this regard, and not when the law continues to be murky and dynamic (and abused). It's the abused dog effect: even if you, personally, treat a previously abused dog really well and swear up and down that you will never hurt it, if you raise your hand around it, it'll cower. Since technical solutions exist for this problem, Dropbox's reasoning gets a bit thinner. > If they're going to supply access via the website, or allow you to share with others then they need to be able to decrypt the file. Not necessarily. For example, a key derivation function could be used to transform a password into a key, and that password could be required for users that want that kind of thing. As far as website access goes, I'm about to commit a terrible security crime here and suggest that the key derivation function could also be run in the browser. This would prevent direct access to your data by anybody at Dropbox, at least until the next time you log in, at which point they could serve up some malicious code that would record your password and ship it off to them. There are workarounds for that, too, though.