Lots of ways, for example: Delegate authentication to another server, have your authentication server go down, mess up a try/catch clause in your app that does

Lots of ways, for example: Delegate authentication to another server, have your authentication server go down, mess up a try/catch clause in your app that doesn't handle a bad connection correctly It's very doubtful something like Dropbox is as simple as if(user.hashedPassword == sha1(salt + enteredPassword)) { letUserIn(); } else { error(); } Who knows though, it could have been something even as simple as if(user.hashedPassword == sha1(salt + enteredPassword)) ; { letUserIn(); } Now everyone gets in!