This is a better argument, but rarely given. The issue is the accepted argument made for 'username or password is incorrect' is it's a best practice protecting

This is a better argument, but rarely given. The issue is the accepted argument made for 'username or password is incorrect' is it's a best practice protecting the existence of accounts on sign ins, yet sign ups are ignored.