The "last login" message string could appear in the splash screen that
comes up while GNOME is being initialized...
There just should not be any indication that the username is valid until
after the password is correctly entered. One of the reasons I also
intensely dislike "click to login" interfaces like XP and "Happy GNOME
with Browser"
Show replies by date