An interesting concept, albeit insecure. You should never tell the user which element of authentication was incorrect. Tell the user their username is incorrec

An interesting concept, albeit insecure. You should never tell the user which element of authentication was incorrect. Tell the user their username is incorrect and you open yourself up to brute force enumeration of user accounts. Tell the user their password is incorrect and there's now an easily scriptable way of brute forcing logins for an individual user. The correct thing is to tell the user their credentials were incorrect, and offer a recovery mechanism based on something else (like an email password reset process).