An administrator can turn off the face browser to prevent folks from
knowing valid usernames.  However, as with the ESMTP VRFY command, GDM will
respond differently to valid and invalid usernames.  If a valid username is
entered with an incorrect or missing password, a message of the form "You
have entered an invalid username or password" is displayed in the GDM
window.  If an invalid username is entered, no matter the password, a
dialog pops up with the message "Authentication failed."  In this manner,
it is obvious when you have hit upon a valid usename (and the message "You
have entered an invalid username or password" might as well read "You have
entered an invalid password").