It is good practice to just supply a simple Username or Password is invalid message. If the user is performing a reset, ask for their email address and send an email to that account stating it is not a valid email address or send the reset link if it is. The less information you can expose directly on the site the better. It is also a good idea to have the login name and name displayed and used on the site different.
David-
- 434
- 2
- 8