web Account enumeration on web applications Why a generic message to prevent user enumeration is an acceptable user experience degradation to improve security
