If a login fails; should the site explicitly tell the user if it was the username or the password that was wrong? or should it just tell that the combination of username/password was wrong (ie. no clue if such a username even exists on the site)? What is considered best practice for this?
Of course on Unix-systems no clue is given, and the user is just informed that the username/password is incorrect. This is obviously more secure; as it prevent crackers from even knowing if such a user even exists on the system, or if it was just the wrong password. On the other hand, for legit user this hardly poses any problems, as you probably don't have that many accounts on different Unix-machines, nor is likely to try logging-in on random Unix-computers - you ought to remember the correct user-name for your few accounts.
On the web though, there are lots and lots of sites, and it's easy to loose track of which services you've signed-up for (for me at least) — not to mention what username you used. I at least find it annoying if after several failed attempts at remembering my correct password, I discover that I don't actually have an account on the site — at least not with the username I tried.
So any thoughts? Should the user be told if it is the username or password that is wrong? or should he just be told that the combination is wrong (which could mean no such account exists at all)?