plataformatec/devise — pull request #2147 by gabetax (2012-11-18 23:15:44+00:00)
Title: Support alternate sign in error message when email record does not exist

It can enhance user experience while signing in if the user can be explicitly told that their account does not exist, so they can try using any alternate or site-specific email addresses they have.

Currently devise uses the :invalid message, 'Invalid email or password.' when the user's account does not exist.

It is arguably less secure to allow attackers to figure out whether or not an given email address has an account in the system. However, this information is already exposed in the :recoverable module.

I propose that devise returns an alternate failure key when the account database record does not exist, and the end-developer can choose to expose this information by customizing their en.yml file.