A cracked spreadsheet, a dead man's passwords, and the control nobody documents

The keyspace is where this story actually turns. A 13-character password drawn from the full printable set runs to about 5.1e25 candidates; against the rig Pen Test Partners describes, which it says sustains more than 10 billion hashes per second ^[7], that is on the order of 160 million years ^[16]. Once the family remembered that he wrote passwords as word, digit, exclamation, word ^[5], the same secret became a combinator run: roughly 80,000 dictionary entries decorated with a digit and an optional bang, combined against an 88,000-word list ^[6]. Assume one digit and the optional character, and that is about 1.4e11 candidates, near fourteen seconds of GPU time ^[15]. The firm reports it fell in under a minute ^[7].

Nothing before that recollection could have worked. The team brute-forced to nine characters and ran dictionaries with rules and family-suggested words over a weekend ^[4], while the answer sat four characters past the ceiling they were sweeping ^[14]. The password itself was not weak by construction, 13 characters with mixed character classes, and the firm's stated flaw was the two dictionary words inside it ^[8].

So the man did the thing every security programme asks for. Strong, unique credentials everywhere, stored encrypted ^[2]. The part that failed was ownership of recovery, and his family were locked out of everything ^[1]. The blog's author treats that as an engineering problem rather than a paperwork one, and his own arrangement is worth reading as a control specification: a named colleague, Scott, has agreed in advance to simplify the network and strip out Home Assistant, and keeps whatever he removes, with the author's passwords written down, secured and accessible to others ^[12]. That is a succession plan with a degradation path attached, which matters when Home Assistant is the thing controlling physical access across a 10-VLAN Ubiquiti stack, two internet connections and a Proxmox cluster ^[11]. A locked-out household there is a door problem, not an inconvenience.

The inversion is the uncomfortable part. The format knowledge that rescued this family is the same asset an attacker wants, and the firm's own guidance says so: memorable-format schemes are acceptable for online accounts sitting behind a lockout policy, and not for anything attackable offline or exposed in a compromised database, where length and the absence of dictionary words are what count ^[9]. A house style for passwords is a shared secret across every hash you have ever leaked.

This is one vendor's account of one job, and the throughput figure is self-reported ^[7]. Take the list it ends on as the audit scope, though, because it is more concrete than most break-glass documentation: device and laptop access, BitLocker, the password manager's own master credential, then domain registrar, finance, insurance and house control ^[10]. Every one of those is a single-custodian dependency until someone writes down who inherits it.