On why telling users if it is the username or password that is incorrect they say... But after some further consideration, we decided that it was a fal

On why telling users if it is the username or password that is incorrect they say... But after some further consideration, we decided that it was a false risk, as the username reminder form already tells you if a username exists, and is not a significant security risk for the bajilions of sites that have them. Oh, damn i didn't realize bajilions of sites do this and yet are so secure. Next time, a better response i hope: "but instead we decided allow for error differentiation while also increasing the controls on the number of failed logins allowed and alerts to security staff in such cases." <pulls out brute force scripts> PS. just never let anyone from marketing, design or management discuss your security publicly without review.