I don't think it's safe or even good practice to tell a user specifically what part of my authentication credentials is faulty. I practically guessed my way to my correct username because SO let me know that the username portion of my credentials was incorrect. Then I moved to my password and I guessed my way (until I got tired of it). And SO kept letting me know that it was just my password that was the problem. That is a problem (to me anyway). And there is no lockout policy or anything after several failed attempts. What do you guys think?