Can trojans steal passwords without permissions?