The article makes a good point, were it not for security auditors (SAs). SA: You leak information and therefore violate policy by disclosing on the login form

The article makes a good point, were it not for security auditors (SAs). SA: You leak information and therefore violate policy by disclosing on the login form whether an account exists or not! Me: Yeah, but figuring out if an account exists is really simple anyway: just a query to a different endpoint... SA: NEVERMIND, MY LAD: disclosing account existence upon login violates BEST PRACTICES! Me: OK, yeah, whatever, we'll just change the error message to "something you may or not have entered may or may not be valid information, try again, or not" SA: cool beans! WE ARE NOW INDUSTRY LEADERS