I need to alter the default D7 message that gets presented to the user on a failed login attempt. I need to give them one message if their username isn't found, and another if their password is wrong. Default Drupal behavior is to give a single, generic error message that doesn't distinguish between the two.
For the password check, The best solution I've found is user_check_password(). This doesn't sit well with me. The password.inc file isn't included in all page requests, and as there are several different context dependent login pages on the site, it isn't always there. I've been forced to require_once it in my custom validation handler which seems very un-drupal-ish.