It's defense in depth. Why tell a probable attacker that they have the correct username if you can hide it from them. The less you give them the better. Most us

It's defense in depth. Why tell a probable attacker that they have the correct username if you can hide it from them. The less you give them the better. Most users will know if they got their username incorrect, it's right there in front of them on the screen. The slowed down responses (exponential back-off) is a the preferred method of rate limiting over account lockout. "Or they'll dump the username:passwd database if they get in. In that case, obfuscating usernames is moot anyways." Well if they can dump your DB it's game over for your whole app and possibly infrastructure anyways.