The aim is therefore to remove the reliance on it being genuine. If you don't have passwords then there is no passwords to steal.