If you have a sign-up page, the usual "invalid email or password" message on sign-in form doesn't increase security.