Yes. IIRC, earlier stories said specifically "impersonating other users", not using other users' passwords.