IdStory Identity Manager

Well, it's easy to distinguish non-existing username from existing username, because the login attempt for existing username with incorrect password is about 1.5s and login attempt for non-existing username is about 3x quicker. At least in my environment (authentication against remote system may slow it down a bit, but still...).

So these security reasons don't work. Only the message is misleading. Could you please reopen the issue and discuss it again?

Sorry, I reacted for a bit different scenario - I think we should display the message about blocked login, if the password is correct OR incorrect. As Miluš suggested. So the attacker doesn't know if the password he tried is wrong or correct. But the users know that it's useless to try.
Then the only thing which attackers could know from the message is the information about correct login - which he knows already due to slower response in his previous attempts.

Alena Peterová wrote:

Only the message is misleading.

Message isn't misleading, but Milus doesn't know about notification (email) that is send to blocked identity.

Ondřej Kopr wrote:

Alena Peterová wrote:

Only the message is misleading.

Message isn't misleading, but Milus doesn't know about notification (email) that is send to blocked identity.

The message in GUI is misleading = it doesn't tell the truth :-) I know about mail notification, but the notification doesn't always come to the user (e.g. new user who doesn't have access to his mail yet, he must set up is password through IdM. Or he just doesn't notice the message in time when he tries to login to IdM).
As I said in #1529#note-4, I think there is no new security risk in showing the message "Your account is blocked". The attacker can guess the login just from the response time. This security risk can be prevented only by the blacklisting you mentioned in #1529#note-3 or something.