Unfortunately just encrypting the login page would not protect user accounts from Tunisia's ISP. The ISP can just sniff your session cookie and hijack your session instead. They won't be able to change your password but they can read and write all your other data.
The only real protection here is to go full SSL and not forget to set the SSL only flag on session cookies. Even then, you only have to wait till Tunisia buys a forged certificate for Facebook.
Sorry, either either the autolinker or I screwed up that post. My point was that if people cared about security, they could have been visting the facebook login page by manually typing HTTPS in the first place.
I don't use FB, but someone on Slashdot was saying it likes to reply with every link going to http anyway. Based on my experience with Twitter and other sites, this sounds very plausible.
The only real protection here is to go full SSL and not forget to set the SSL only flag on session cookies. Even then, you only have to wait till Tunisia buys a forged certificate for Facebook.