When I enter my username and password on a site where there is no certificate, can they be stolen?
it depends on the message you get from the browser
Not secure: Proceed with caution. Something is severely wrong with the privacy of this site’s connection. Someone might be able to see the information you send or get through this site.
You might see a "Login not secure" or "Payment not secure" message.
Dangerous: Avoid this site. If you see a full-page red warning screen, the site has been flagged as unsafe by Safe Browsing. Using the site will likely put your private information at risk.