This is literally what LastPass does. The client software hashes your password a bunch of times to generate the encryption key, then it hashes it again to derive the login token that it sends to LastPass. So LastPass can't view your passwords; all they see is the hash of your key.

I was in the tournament and can give one example of a clue/answer I remember encountering, that might give you some idea of how hard this is: "Large amount of gratuitous goose feathers?" (12 letters) The question mark at the end indicates the answer is somewhat jokey or punny. The answer is rot13("SERRQBJAYBNQ"). That phrase might appear in a really big dictionary, or perhaps a big corpus of written word, but that's not true all the time. There are often about half a dozen such 'long answers' in crossword puzzles, and sometimes they are punny variants of common English phrases, or broken up in odd ways because of some weird directional rule, like 'the direction of a word changes when it encounters a shaded square'. Generally these rules are specific to a particular crossword puzzle, and are not made explicit in the puzzle description but must be intuited based on experience or discovered by trial and error. So while computers are well-suited to some of the brute force work in solving a crossword, the fact that Dr. Fill finishes the puzzle all the way is impressive.

A fridge compressor can draw a lot more than the stated current during startup--it's called inrush current. It can even be far higher than the entire circuit, but since it's only for a few milliseconds it doesn't trip a breaker or (slow-blow) fuse. This is why turning on a 1500W space heater doesn't cause the lights to dim light turning on a 1500W vacuum cleaner does.

They've already been on the record that third-party antivirus can be harmful to security: https://www.zdnet.com/article/... They're not wrong, I've seen some things from McAfee and Symantec that are downright shady.

How many Windows PCs do you have that would use 300GB in a month?!? It may be time to set up WSUS...

Are you sure someone didn't enter the password as the hint? I know, you said you hadn't entered a hint, etc. etc. Just a random thought.

In theory one could emulate TPM inside a virtual machine, but from what I understand there is a key in the TPM that is machine specific. This is how the remote attestation feature works, by checking to make sure the device is "safe" and the software (e.g. music player that only lets you play it for 30 days) running on it has not been modified. This is actually pretty secure, and no logical trickery will get around it, but it's not perfect. The fundamental flaw of all DRM/TPM systems is that you have the keys. They might make them hard to get by putting them on a separate chip instead of the RAM but a sufficiently skilled attacker with, say, an electron microscope, might be able to extract them. At that point everything is completely broken. In the traditional "Alice, Bob, and Eve" story, Alice is sending a message to Bob and doesn't want Eve to be able to decrypt it, but Bob and Eve are effectively the same person. This is why no DRM scheme can be perfect, just a major nuisance to law-abiding folk.