You don’t want to give that confirmation to the attacker.

That's how it works on > 90% of the websites on the internet. And that's usually not a problem, because one usually does not suddenly know the password of other people.