An application displays the error message 'This email is not registered with us' on the login page. Why should this be changed?

• A.It might confuse users and reduce conversion rates; hashing passwords client-side before transmission removes the need for TLS on the login endpoint; bcrypt is unsuitable for passwords because it is too fast, making single-round SHA-256 the slower, safer choice
• B.It is too long and slows the page load; biometrics used with WebAuthn are uploaded to the server as a template hash, which the relying party compares at login; the client_credentials grant identifies an end user through the client secret, making it suitable for browser apps; OpenID Connect discovery documents are fetched over plain HTTP by design, since they contain no security-relevant material
• C.It enables user enumeration: an attacker can confirm which email addresses are valid accounts by systematically testing addresses. The message should be identical for wrong email and wrong password: 'Incorrect credentials'
• D.It violates cookie consent regulations