Any decent error message is a kind of oracle

This person ignores the security risks from being too verbose and/or specific with error messages, especially if they’re coming from a server.

You’ll usually fail security/pen-test audits if you follow the advice given here.

I agree that doing a better job of helping the user is laudable, but you need to know which battles to fight.

For debugging purposes, because having users tell you what error they got is sometimes very useful:

generate a random number (e.g. a uuid), log it with the error, and display that number.

doesn't leak data because it's different every time, but you can uniquely pair it up with what they are seeing.

> So why aren’t these errors better? “Password is incorrect, try again.” or, “No account exists for this email.” Is that so hard?

I can tell you exactly why I don't do this, for my app.

I don't want to indicate which of the fields is an issue.

Most folks use Sign up with Apple, though, which obviates this.

The best error message is to avoid the error; either by effective design, or by good affordances.

But this is what WFM. YMMV.