They're lying about the issue and don't trust that you're who you say you are. It's security systems 101. If you give informative error messages, they can be used to reverse engineer the password of accounts. So every error is going to be "incorrect password"

[–] cron@feddit.org 2 points 2 weeks ago

Sounds like security by obscurity to me. Works, but rarely the best solution.

[–] marcos@lemmy.world 1 points 2 weeks ago

That part is possible:

They’re lying about the issue and don’t trust that you’re who you say you are.

The rest of your comment is just bad. I doubt you even manage to keep that information secret, much less get a positive value out of the entire machination.