Why can't a keyboard on the Samsung Galaxy S3 collect passwords? When I enable an input method (a keyboard app) on a Nexus device, I see the following confirmation message:


  This input method may be able to collect all the text that you type, including personal data like passwords and credit card numbers. It comes from the app Highway. Use this input method?


I understand this warning. Because of the way an input method works, it has the ability to collect everything I type, and I have to trust the author not to abuse this ability. But when I enable an input method on my Samsung Galaxy S3 (and maybe other Samsung devices; I haven't tried), I get a different message (my emphasis):


  This method can collect all of the text you enter, except passwords, including personal data and credit card numbers. It comes from the app Highway. Use anyway?


I've checked entering a password into a web form, and setting the device password. In both cases, it still uses the (3rd-party) input method I choose to enter the password. So why does Samsung claim that the input method can't collect passwords? Are they doing something incredibly clever in their version of Android, or are they just talking nonsense?
As a programmer I find this interesting.  Password fields can be (and usually are) treated differently than normal text boxes.  Given that Android is open source I guess it's possible that Samsung has at least attempted to include code that prevents a password field from passing information typed in it back to the keyboard application, but like others have stated I am skeptical.  

In order for a keyboard application to collect your data it has to include the extra step of capturing your input, storing it somewhere, even if it's just temporarily in an instance variable, and then sending it on to a third party.  I would be interested to hear what Samsung says about this and how they supposedly prevent it, but I'm guessing that's an answer we aren't likely to get.