Which of the following is a principal threat to password secrecy?

• A. Phishing attempts
• B. Firmware updates
• C. Offline dictionary attacks
• D. Software installations

Answer: (C)

Password secrecy is primarily compromised by offline dictionary attacks, which involve an attacker using pre-computed lists of passwords and their hash values to crack passwords without needing to interact with the original system. The attacker can take these hashes and compare them against the dictionary of possible passwords offline, allowing them to try numerous combinations rapidly without detection.

In such attacks, if a password is weak or commonly used, it becomes easier to crack, leading to a severe breach of security. Offline dictionary attacks exploit the fact that many users rely on easily guessable passwords, such as "123456" or "password," which are often included in these dictionaries.

Other options, while they may pose risks, do not directly threaten password secrecy to the same extent. Phishing attempts rely on tricking users into revealing their passwords directly, while firmware updates and software installations typically do not engage in unauthorized password access unless there's accompanying malware. Hence, the nature and method of offline dictionary attacks make them a principal threat to password secrecy.