“Invalid username or password” is a useless security measure413 points by kevinburkeRead the articleDiscussion on Hacker News