Calvin, a grey-hat hacker, targets a web application that has design flaws in its authentication mechanism. He enumerates usernames from the login form of the web application, which requests users…

Insecure transmission of credentials refers to sending sensitive authentication data without proper encryption, allowing eavesdropping, which is distinct from enumerating usernames via login form responses.

Verbose failure messages on a login form, specifically those that differentiate between an 'invalid username' and an 'invalid password' or indicate which field is incorrect, expose information about valid user accounts. This design flaw allows attackers to enumerate existing usernames, which can then be used for targeted brute-force attacks or social engineering campaigns.

User impersonation is the act of successfully pretending to be another user, which is an outcome of exploiting a vulnerability, not the design flaw itself that permits username enumeration.

A password reset mechanism vulnerability would involve flaws in the process of resetting forgotten passwords, such as weak token generation or improper email validation, not the informative error messages on a standard login form.