+1 for security theater. If 1Pass app is compromised, you're compromised - period. Even with app permissions, does it not still have file system access? I don't see how this change would prevent it from accessing all your Dropbox files anyway. Also, since Dropbox uses an exploit to gain permissions, I'd say we're placing blame in entirely the wrong place here. On the other hand, the 1Pass folks in that thread are giving all the wrong reasons. "We won't do this because it's hard," is very different from, "we won't do this because it offers no benefit in any scenario." Users who are security conscious aren't using Dropbox to sync their password vaults.