@Eth here references how "...a dapp can effectively have two back-ends..."
In other words how can a user trust they are receiving trustless data?
If you want to be sure that the dapp is showing you the data that it claims to be showing you, you need to check the source code of the dapp.
Currently dapps are often hosted on someone's website or - only slightly better - on a github.io site. When they're doing this it would be quite easy for the host to change the source code and make it do something else.
Wallet software like MetaMask can mitigate this somewhat by showing users what they're doing before they send transactions. But even here, there are lots of ways you could imagine someone could be tricked into sending a transaction based on bad information, and it's also hard for them to tell what kind of transaction they are sending. A lot of the UX problems here are unresolved, and there will be SFYL while the world learns how to do it right.
Another thing that will probably ultimately help is tamper-proofing the deployed code, and using smart contracts to enforce the process by which code gets put in front of the user. If you load your code directly off IPFS, or you have a browser extension that hashes the code it's got, you can reduce a software version to a single hash. You can then have a smart contract that requires a deployment to go through a particular process; For example, code needs to be published for x days before deployment and people can object on payment of a bond, or that it needs to be signed off on by developers x, y and z, etc.