So, we have this article:
Apparently, using nothing but spaces the local account (with an obviously saved password... I hope) was compromised. I am guessing that the password was TRIMMED before comparison and the dad had a password of merely spaces to begin with. Although, for a dad who is a "security researcher" this is seems awfully naive.
So, what does Security.SE think? Is there an affirmative source that confirms how this exploit works?