today i have seen a problem with the Stackoverflow login mechanism.
At my opinion a service which tells the user: your email is wrong and if the email is correct it says the password is wrong is definitely not secure.
Because if some wants to get access to some account he types an email address which could be correct and changed it a little bit until he gets the message the password is incorrect. At this moment he knows the email address is registered. After that he tries some passwords which can be maybe possible if he knows the person or he use a dictionary attack. I think this problem should be fixed.