Strike 1 was when they got caught lying about whether their employees could decrypt your files or not.

I suppose so, I always took that statement to be that employees didn't have easy access to your files (such as without decrypting from the servers).

It should have been obvious to anyone else remotely familiar with security that dropbox had/has access to your files from the simple fact that you could reset your password, as well as the web interface.

wewyar, like kragen & iamjustlooking pointed out I considered that whole episode as strike1. I agree I am being extremely critical and have to agree in spirit that this is their real goof up. Poor security is not a reason to abandon the ship if they show an intent to fix it ASAP. What I felt a bit let down by this whole take down thing was, their initial approach was to surpress the hackers rather than fix their problem. I see in another post they seem to addressed it the loophole (?), which is the way to go. Embrace ppl tinkering this way but make your platform robust.

I assume strike one is this:

http://dereknewton.com/2011/04/dropbox-authentication-static...