It is really common (and I would say it is some kind of security basic) to not show on the login page if the username or the password was wrong when a user tries to log in. One should show a generic message instead, like "Password or username are wrong".
The reason is not to show potential attackers which usernames are already taken, so it'll be harder to 'hack' an existing account.
Sounded reasonable for me, but then something different came on my mind.
When you register your account, you type in your username. And when it is already taken, you get an error message - which is not generic!
So basically, an attacker could just grab 'correct' user names from the register page, or am I wrong?
So what is the point about generic messages than? Non-generic messages would lead to a much better UX.