Should I provide separate messages for the wrong password and the wrong username? Or keep the same for safety?

Question

I think that individual messages can make the user less disappointing, as someone who has forgotten their details has less opportunity to narrow it down. However, it is then possible for someone to continue to clean the site to determine the list of usernames that they use.

Should I take a small security issue to create a better user interface?

Answer 1

When it comes to security, I would always be mistaken on the side of caution . Use a generic message.

Answer 2

No, it's not worth it. To be safe, you want to provide as little information as possible.