I think there is an important point which is ignored, in the article and here in the thread: typos. Unfortunately, when designing a login flow (and a signup on

I think there is an important point which is ignored, in the article and here in the thread: typos. Unfortunately, when designing a login flow (and a signup one), you can’t assume that the user always inputs the right things. Try logging in into facebook, for example, mistyping gmail or with your password with the wrong case, like all uppercase. In many cases... you get in! This is to prove that they had to “improve” their flow to account for wrong user input. Because user input can be wrong in both email or password, the error message should account for both.