Calvin, a grey-hat hacker, targets a web application that has design flaws in its authentication mechanism. He enumerates usernames from the login form of the web application, which requests users to

Insecure transmission of credentials is a transport-layer flaw where login data is sent over unencrypted protocols like HTTP instead of HTTPS, which is unrelated to the error message specificity that Calvin exploited.

Verbose failure messages occur when an authentication form returns field-specific errors such as 'Username does not exist' versus 'Incorrect password', revealing whether a given username is valid. This lets Calvin systematically confirm real accounts through repeated attempts, then use that verified list of real usernames as a foundation for targeted social engineering campaigns.

User impersonation refers to an attacker assuming the identity of a legitimate user after credential theft, not the upstream process of discovering which usernames exist via error message analysis.

Password reset mechanism vulnerabilities involve flaws in the recovery flow such as predictable tokens or weak security questions, which is a separate authentication design flaw from how error messages disclose field validity.