Looking at security of a website, it has to be just the way it it. It should not prompt whether or not username or password is incorrect..and if it does, then it would be vulnerable.
It prevents hacker to know about whether he has got right username or not? If he knows that then he can tryout various passwords using the username he guessed earlier.
