Most people have already answered you. The problem is anyone in the middle can hijack the page and put whatever they want there. See what I mentioned here in th

Most people have already answered you. The problem is anyone in the middle can hijack the page and put whatever they want there. See what I mentioned here in the past: https://news.ycombinator.com/item?id=25123366 https://news.ycombinator.com/item?id=25123366 Now imagine you combine MITM-ing someone with social engineering. You send them a legitimate inocuous link like http://my-bank.my-tld http://my-bank.my-tld, but you are MITM-ing them and outright replace the content of the page with whatever you want. Yes, HSTS protects agains this example, but the problem still remains: whatever goes through HTTP can be manipulated and used for nefarious ends. It's kinda like walking around with a car door open waiting for someone to throw a bomb inside it.