Welcome to the "Totally Legit Bank".

You can trust us with your money!

Obviously this is a fake website.

It is also obvious that it is not safe to enter your credentials on this site, even though it uses "https" and may say "secure" on some browsers.

The purpose of this site:

The purpose of this site is to demonstrate a fundamental flaw with stating that the "s" in https means that a site is "secure". The "s" means that the site uses SSL/TLS to encrypt the traffic going to and from the web server. This is definitely a good thing, as it stops a malicious third party that might be trying to "listen" to what you send to a website from actually being able to understand anything that they might intercept. This type of encryption ensures that only you and the web server will understand the information being exchanged (under most circumstances). This does not mean however that the site that you are visiting is safe, or even that everything that they do is secure. What it does mean is that they have gotten one very small part of properly hosting a website correct.

With that being said, it is fair to say that if a website does not use SSL/TLS (they don't have the "s" in https), they are not secure. Information Security uses the CIA (confidentiality, integrity, and availability) triad as the foundation of what we should be protecting. Encrypting traffic between the client and the web server affects both confidentiality (ensuring that no one can read the data besides who it was intended for) and integrity (ensuring that the data is not modified between the sender and the recipient). This means that even if you aren't submitting sensitive data to the website, a malicious third party attempting to intercept your traffic could inject malicious code into an otherwise legitimate page, or otherwise modify the content. (See https://semsec.net/2018/06/23/ssl-tls/ for more details.)