While this is true in the absolute sense, it's one of those things where you have to think about non-technical users: something like this would just confuse the

While this is true in the absolute sense, it's one of those things where you have to think about non-technical users: something like this would just confuse them, unless you make it very clear in the message that either one of those are bad, and provide a clear path to recovery... Having a good UX/security UX is hard.