Persona assumes something trivially false for most end users: that email addresses are canonical and precious; in fact, email addresses tend to be recycled (by schools and ISPs), users have many of them (causing them to never remember which one hey are using, a problem compounded y the usage of clients that aggregate their email together), and they are extremely temporary (users throw them away and get new ones when they start getting too much spam, and are even forced to do so when they change jobs, graduate from school, move to a new area, or simply change email providers, as even savvy users tend to rely on third-party domains, including gmail.com).

This makes persona both frustrating for the user (having to do account migrations at the least convenient time on every website they use, always using the least convenient flow as by the time they notice they have already lost access to their old email address) and insecure for everyone involved (the situation where user's account is compromised when their email address is recycled is bad for everyone). In comparison, users tend to have one account on Facebook, and that account is theirs and theirs alone essentially forever.

Facebook has amazingly well-engineered mechanisms to do account password recovery (my favorite is the one that shows you uncommon pictures of your friends--old shots, people in Halloween costumes, etc.--and asks you to identify them), the account has a username independent of email addresses (to the limited extent to which email addresses matter, if the user changes addresses Facebook will be the first thing they think of to update before they go through with the process, and even if they don't they will catch it immediately as most normal users use Facebook often), and Facebook provides a central location to store a bunch of common profile information (in particular a picture) that the user will actually keep up to date (which is pleasant for both the user and the website). Using Facebook as a login provider actually solves problems for both users and website operators in a reasonably secure manner.

Users on websites like Hacker News, developers, the kinds of people who build websites, sadly don't notice these problems, as they are the kind of people who value email addresses and understand the issues related to security if addresses are reused: this is fundamentally unlike a normal user or sadly even a normal system administrator. I have been saurik@saurik.com since 1997 and will be until the day email is dead: I was really argumentative any time my University asked me to use saurik@cs.ucsb.edu (an address they later cancelled on me and recycled :/) and so avoided third-party addresses, and noticed the canonicalization problem after only a year of saurik@poboxes.com (a service that happened to also help users get "vanity" email addresses, as users care more about cool addresses on domains like starfleet.com than ones that won't change). I am not typical: Persona, sadly, is designed for users like me at the exclusion of normal people :(.

For more details about these issues, I will refer you to earlier discussions of Persona and social login mechanisms, where I provided much longer comments, examples, walkthroughs, etc.

https://news.ycombinator.com/item?id=7243021

https://news.ycombinator.com/item?id=5408735