Lots of ways, for example: Delegate authentication to another server, have your authentication server go down, mess up a try/catch clause in your app that doesn't handle a bad connection correctly

It's very doubtful something like Dropbox is as simple as

  if(user.hashedPassword == sha1(salt + enteredPassword)) {
    letUserIn();
  } else {
    error();
  }

Who knows though, it could have been something even as simple as

  if(user.hashedPassword == sha1(salt + enteredPassword)) ; {
    letUserIn();
  }

Now everyone gets in!