I assume strike one is this:

http://dereknewton.com/2011/04/dropbox-authentication-static...