We should not have a separate message for bad user and bad password, should just always say “password failure”

 

Thanks,

Shawn.