I don't get how a HTTPS connection over Tor can be insecure. Where's the difference between a normal HTTPS connection and a Tor -> HTTP connection? Many sites recommend to use the Onion-URL instead of the HTTPS-URL. Where is the benefit?
Tor provides you with anonymity.
HTTPS protects (encrypts) the content of your data.
HTTP provides none of these.
Tor provides anonymity but does not protect the exploitation of an insecure application to reveal the IP address of, or trace, a TCP stream.
Running HTTP over Tor means your communication data could be read and thus compromise your anonymity.
Here are 4 schemas showing the difference between using HTTP, Tor+HTTP, HTTPS, Tor+HTTPS (the green button reflects the used protocol) regarding what an attacker (eavesdropper) may see:
Tor provides anonymity which HTTPS does not provide. HTTPS only provides end-to-end encryption, but a man in the middle can still see where you are connecting to and might find out more (i.e. which sites your are looking at in detail) by doing statistical analysis of the sniffed traffic.
Tor tries its best to hide the meta-information like source and destination of the request. It also provides encryption, but only up to the exit node of the Tor network. So you should better be using HTTPS on top of Tor if you visit a public site. Tor is not able to protect the traffic once it left the exit node.
Onion-URL's are URL's inside the Tor network itself. That is in this case you don't leave the Tor network when accessing the data. Usually only few sites are accessible by an Onion-URL and also by a public HTTPS-URL, but instead they are accessible either by Onion URL or HTTPS-URL only. So the recommendation to use Onion-URL instead of HTTPS can not be applied for most sites.
I hope I could clear up some confusions in your question. In short
- Tor over HTTPS: there is no such thing (only HTTPS over Tor, see below).
- Access of Onion-URL: recommend because traffic does not leave the Tor network. Best option if available.
- HTTPS over Tor: recommended, because it protects traffic after leaving exit node. Second best option.
- Plain HTTP (not HTTPS) over Tor: not recommended because not safe after the exit node. Use HTTPS if possible.