Comment by scaglio

About "10. If the user guesses an invalid password, say why it’s invalid", it's terrible from a security perspective. If the password is wrong, it is wrong. A potential attacker must have no clue of what he guessed.