When you can show me a tcpdump of your password being sent to CarrierIQ I will believe they are capturing your password.

All I've seen proof of so far is that it is capable of doing so because of how it is called before everything for anything, but let's not jump to conclusions here.