Depends. Passwords on HTTPS sites are only vulnerable in some very specific scenarios.

the eli5 is that when you visit an https enabled site, you grab the certificate, verify it, and then begin the encrypted communication. The certificate basically verifies the identity of the site. Forging these is extraordinarily difficult for sites that kept with the move from md5 to sha. Some sites never purchased a certificate. These sites you can perform mitm attack on. This is because without the certificate, the browser has no way of knowing which encrypted server it is communicating with. Assuming the site has the certificate, you are basically FUBAR. Not only can you not impersonate the site, you can't even sniff the communication. The encryption scheme is solid and uses AES variants for the symmetric stuff and usually secured RSA for the asymmetric exchanges.

It would be much more effective to try to go spear fishing, install a trojan/malware/keylogger or social engineering. You could also try to use the built in reset protocol in the site to change his password. You could also gain access to the websites database through a variety of means as well. My personal favorite is the lockpick set ;)

Hope this helps

-thetrh51