You should never tell to end user what was wrong login or password. There should always be single message if any thing is wrong login or password.