That was the wrong password

I got the above screen after failing to login to my Meetup account to RSVP for a meeting.

As a user, I like that it tells me that I used the correct email address but wrong password.

However, this system has just verified information without authentication. It tells me that a valid user email address was used. This information could be helpful to someone trying to gain unauthorized access.

Now, in this case, I don't think disclosing that email accounts exist is a huge deal. This is a social networking site. This is not a banking system. This is not a medical records system. It is not an interface to access private information. Meetup profiles are public and searchable on the web -- although not email addresses. I say no problem in the context of this site.

For other systems, giving non-authenticated people information that narrows down access credential options could be a huge security problem.

It may be possible to correct the problem

cjwl: The Xfce people need a lesson in graceful error recovery, this is at startup. seriously bad UX

Don't tell me my address is invalid!

Flying J lost my business because their email address rules prohibited my valid address.