While it is true that displaying a different message whether or not the username exist might increase the surface attack, you have to realize that generally :
A username is not a secret
- Username are often public (available to anyone that visit the website ex.: forums)
- Username are often email address (public again)
- Username are often reused between multiple sites (public again)
There is very few applications were the username is totally secret. Is it your case? Is there no way for anyone else than the user to know his username? But let's look at the risks...
Security Risk
When we are talking about a username/password combo, there is almost no security risk in revealing the username. Some people might argue that you could make yourself vulnerable to brute force attack but it won't work. Why? It's simply because brute force attacks do not work over a network as in most case you will create a denial of service attack before you are able to crack a single password.
Privacy Risk
The one place where it might be critical to keep a username secret might be when the user do not wish to be associated with the service. BUT... If the user really want to stay secret, why doesn't he chooses a username that cannot be linked to him? If I want to keep my identity secret while I'm using a service, common sense tells me that I should not use my real name, real email or real address at least.
Intersting reads about keeping username secrets
