To address some of your points:<p>1) That is completely controlled by the site owner. In my sites, for example, I just disabled the Persona JS while the user was logged in, so there was no global log-out possible.<p>2) I believe the bridge was just a proof of concept, with the intention of email providers supporting Persona directly so all the security could be implemented there. I know you said &quot;default bridge&quot;, but my side-project here supports 2FA: <a href="https:&#x2F;&#x2F;persowna.net&#x2F;" rel="nofollow">https:&#x2F;&#x2F;persowna.net&#x2F;</a><p>3) That is very true, some UX changes were necessary, but imagine if the browser itself could just pop up a window saying &quot;do you want to log in to this site using your email address? Yes&#x2F;No&quot;, done.