After an unsuccessful login attempt, should I inform the user about its reason? Or more generally, how much information about the reason for an unsuccessful login attempt should a web application give?
It's kinda obvious not to inform the user about an incorrect password alone, but to couple it with login - such as 'Email or password is wrong' (or isn't it?). But I started to wonder about informing the user that the account was suspended/banned. Is it too much information? If I give away this information, what I'm giving also is 'this account is registered with this service'. Consequently, if users' emails are used as the login, 'this email is valid'.
But all of this information an attacker could pull out of the registration form trying to register different emails/logins - unless the application would obfuscate the reason for unsuccessful account creation (just 'Couldn't create account with given data'), which is not the best idea from a UX point of view.
With that in mind, lets go step back to unsuccessful login - if an attacker can pull out information about registered email with certain service isn't it just plain stupid to say 'Email or password is wrong'? Malicious/power users will have this information either way, and an unskilled user has to check the login/email and password all over again.
In the end it looks like a Lose-Lose situation ('No security Win - UX Flaw').
I rethought giving out information about a blocked account - of course this information should be given after providing correct credentials (and then it's not a problem to give even more info about reason for blocking the account, date due and so on...), so it's out of the question.
Please consider this question as a question about a design flaw in wepapps. I'm not asking about counter measures to take to prevent brute force attacks (CAPTACHS after a few attempts, blocking a certain IP for few minutes after another few attempts, and so on...)