After an unsuccessful attempt to login, say "Sorry, that login information didn't work."

If someone wants to reset their password, after they enter their email address say "Thanks. If that email address is in our database we will send a reset link."