But the error message can be true. If you mistype your username, you might have entered another, existing username. Just telling the user 'wrong password' will mean they are less likely to check that the username was correct.
The website doesn't always know which one you got wrong, and assuming one way or the other just makes things worse.
The website doesn't always know which one you got wrong, and assuming one way or the other just makes things worse.