Perhaps not enough people who operate websites for profit, but there are a reasonable number of us working on PaaS/SaaS products where using Facebook Connect is

Perhaps not enough people who operate websites for profit, but there are a reasonable number of us working on PaaS/SaaS products where using Facebook Connect is out of the question because of data-protection laws, which does leave a pain-point around user management. The current gold standard is "roll your own", but Persona is an interesting alternative. Why aren't people using it even in that sphere? One issue is that it's precisely when you need to take advantage of the federated aspect that the win on up-front effort is weakened. By the time you're setting up your own in-house Persona server rather than using Mozilla's, you're probably at the point where it's less effort to just use some crappy off-the-shelf account-management system that comes as a CMS plugin. This might be counteracted if using Persona improved conversion, but that's a chicken-and-egg problem as long as users don't recognize Persona. The other bit imo is that the security downsides of roll-your-own are a bit of an unpriced externality. If you have a password breach, it's bad PR for a bit, but legal liability around it is relatively toothless: data-protection laws seem not to care about mere incompetence in keeping users' data private. Make your users pick passwords with at least 2 digits and 2 non-digit characters and you've "done your part". So rolling your own crappy login system doesn't have as big a downside for you the provider as for your users. The users, for their part, are oblivious to the risk before the fact, and lack serious legal recourse after the fact, so they'll go along with your crappy in-house signup system, and shoulder the risk.