I concur, but the value of such a law will not be apparent to anyone who doesn't feel the same way about transparent pants and unencrypted email.

I should also add that I think it's evil to take advantage of the user ignorance of the issue to improve ad targeting.

It depends on the attack vector you're trying to protect against. If you're on a machine you control (e.g., a personal laptop) and can vouch for its security -- that is, you're sure there's no kind of spyware installed -- https should be sufficient protection when connecting on public networks (especially open wireless connections).

Two-factor auth, on the other hand, protects you when you can't guarantee the security of the machine you're using -- someone able to capture the logon sequence won't be able to replay it at a later point in time.

Note that two-factor auth without https isn't clearly of huge benefit, as an attacker with access to your network may be able to capture the session token (e.g., through firesheep or similar tools).