Should inline form validation error messages be specific or unspecific on login screens?

Question

I had designed a message reading "Incorrect password" appearing on the 'Password' input field, however, a PM has given me feedback that saying: "I believe the common practice for security purposes is to generalize the error and not specify that the password is an error. That lets someone know the email is valid and can then continue on a brute force attack to gain access."

He would like me to change it to "Incorrect username or password", displayed at the top of the section.

I'm having trouble finding UX-related documentation online to back this up. Can others please weigh-in?

Answer 1

Well your PM has actually a valid point. Since any attacker can easily guess the username of any user and concentrate his efforts on that particular account using techniques like brute-forcing the password.

Your Question is deeply discussed here . Hope this helps