[homakov]

>This is nothing new. Once XSS has been exploited the users are already pwned regardless of password policy.

stealing password >> XSS.