Re:“Username or password is incorrect” is bullshit
by derimagia on Friday December 22, 2017 @12:20PM
(#15989110)
A lot of places separate out the email/username field so it's a 2-step form. They will show you your avatar and maybe some other public info when you enter the password. This is a better way to do this I believe, although it does make logging in with a password manager [slightly] more annoying.
Unfortunately, when designing a login flow (and a signup one), you can’t assume that the user always inputs the right things.
Try logging in into facebook, for example, mistyping gmail or with your password with the wrong case, like all uppercase. In many cases... you get in! This is to prove that they had to “improve” their flow to account for wrong user input.
Because user input can be wrong in both email or password, the error message should account for both.