In reply to funkah's dead comment: > Doesn't that provide information about which usernames are valid, though? Or does that turn out not to matter? Yes it doe

In reply to funkah's dead comment: > Doesn't that provide information about which usernames are valid, though? Or does that turn out not to matter? Yes it does. A targeted attack would be able to get information out of that. A giant botnet spamming authentication attempts? They apparently don't even notice if their connections are being dropped, never mind the difference between valid and invalid usernames.