Using a rogue proxy server puts you at risk of identity theft and other cybercrimes. This is because server owners and web admins have unlimited access to your data. Thus, they can sell your personal information to criminals without your consent. It depends on how the proxy server is configured. However, in a "running" proxy, they can see all textual content (i.e., not encrypted with SSL/TLS) in both directions. So yes, they could easily pick up all the IDs and passwords.