Yes they need your password but they mix things in the UI making things close to each other, things pop in and out. Its basically a big trap trying to fish as much as they can from you. I don't even install their phone app knowing they will get access to my contacts.