I am looking at an application redesign and one of our business team research says that we are not getting or losing customers because they are not able to login. While I don't really care about the stats, my goal is to see that the app is secure.
The current message is as written in the ancient world "Your username or password is invalid" and this is planned to change to "Your username is invalid". Note this is only to get the username and we have a tight flow for password recovery.
I understand the abuse cases on this change, however, I am always given references of Google, eBay, Facebook... and more, that they do allow user enumeration.
Need comments on how you guys are tackling this issue, strategies, design changes - anything that will help me.