Apple has solved this pretty elegantly using just the machine id. When you purchase an app on the appstore apple creates a receipt that contains a hash of your machine id as well as other meta data. The receipt is then signed with Apples certificate.

When you launch an app you verify the receipt was signed by Apple and that the hash of the current machine id matches the hash of the machine id in the receipt.

Dropbox could generate the same sort of receipt serverside when you first sign in. From then on each time the dropbox client launches it just validates the receipt against the current machine.