there are many things that facebook can and should improve (like enabling https all the time, not as opt in, and not disabling it when you use apps that don't use ssl/tls). that said I'd love if 10% of the web services I use would take security as serious as fb does.