Just today I was writing a json response to an incorrect login. I had the option to discern and inform that the username was not correct, that the password was not correct, or both were not correct. I deliberately decided that I'd code and supply a single error message stating that there were 'something wrong with the credentials supplied'. So I stayed generic in order not to give additional info to any malicious user... so I believe there's at least one good reason to use a generic error message. Am I wrong?