I had designed a message reading "Incorrect password" appearing on the 'Password' input field, however, a PM has given me feedback that saying: "I believe the common practice for security purposes is to generalize the error and not specify that the password is an error. That lets someone know the email is valid and can then continue on a brute force attack to gain access."
He would like me to change it to "Incorrect username or password", displayed at the top of the section.
I'm having trouble finding UX-related documentation online to back this up. Can others please weigh-in?