If there are other ways to confirm whether a user exists or not (signup email check for example) --<p>I would add that the &#x27;bonus&#x27; of not informing of the correct error provides minimal security gain and hurts usability.