When you connect to a VPN, you are connecting to private network, but your network is only private from the greater network/Internet. Inside of the network, you have no additional protections - you are not private to the other members of the network.
You can still use HTTPS/TLS/SSL to encrypt your connection from your PC to the server you want to connect to, but this does not necessarily equate to privacy. Depending on the setup or other factors, you may be exposing yourself to more MitM attacks (ala BEAST) because the path is no longer your PC to your ISP to the interconnections - you have added another network in the middle. Even if they don't break the TLS, there is still metadata about the sites you are visiting and servers you are connecting to while on the VPN which the VPN owner can have (even if they tell you they are not, its hard to verify).
Where possible, you can use certificates to connect to an end point instead of passwords. This is more difficult to intercept. You could layer your VPNS, but most of the time people will turn to systems like TOR or other annonymizing networks. Networks such as tor are decetralized and where you exit the tor network is not always the same; however, if you control enough of the TOR nodes, privacy is not guaranteed.