When signing into websites or mobile applications, if an incorrect username/email or password is entered, you are almost always notified only that "the username or password is incorrect." Why is it common practice to do this, instead of tell the user specifically whether it is the username/email or password that is incorrect?
My guess is it is security-driven to some extent, but if so, how big of a difference is provided in threat protection by ambiguously telling the user that some part of the supplied credentials was incorrect?
I've had plenty of instances - particularly with older or less-frequently visited websites - where I have no idea whether the incorrect part is my email, my password, or both.