I just heard of PoisonTap today. Here is a short description from a TechCrunch article:

PoisonTap connects to the USB port and announces itself not as a USB
device, but an Ethernet interface. The computer, glad to switch over
from battery-sucking Wi-Fi, sends a DHCP request, asking to be
assigned an IP. PoisonTap responds, but in doing so makes it appear
that a huge range of IPs are not in fact out there on servers but
locally connected on the LAN, through this faux wired connection.

And

you don’t even have to be there: pre-loaded items like analytics and
ads will be active, and as soon as one of them sends an HTTP request —
BAM, PoisonTap responds with a barrage of data-caching malicious
iframes for the top million Alexa sites. And those iframes, equipped
with back doors, stick around until someone clears them out.

This sounds quite worrisome, yet I did not hear too much about it yet.
So my main question is:
How vulnerable are people to the PoisonTap hack?
It seems like the following points would be relevant:

Is the general population at risk, or only a very specific subset (OS, browser?)
What exactly is at risk, your data, your gmail account ...?
Is it something that most people can pull off, or does it depend on specific hardware and a high level of skill?
Is there something that one can do easily, without closing all browsers or turning off the PC each time when you walk to a different room to ask a short question. (Is locking it sufficient?)

And of course, if it is as bad as it seems: can we expect updates soon that would make it safer to go to the toilet again?

First the attacker needs to have physical access to the machine in order to plug the device into the USB port. This means any kind of full remote exploit is not possible. It does work though if the computer screen is locked with a password or similar. Note that the physical access does not need to be direct, i.e. it can also be some gullible user plugging a donated USB stick into the system.

Then the device announces itself as a USB ethernet device. This means that the computer will try to add PoisonTap as a network device to the system and get an IP address from it using DHCP. The DHCP response will return an IP address with a /1 subnet so that most IPv4 traffic is sent to the device. From then on the attacker has the same access to the device like a router: in fact the device works as a router for the attacked computer. This means that any traffic can be easily sniffed and modified but that encrypted connections are still protected against decryption and modifications get detected. This means for example that access of gmail over https (the usual way) will not be compromised. 

At the end it is just another way for a local attacker. The impact of the attack is comparable to redirecting someone's traffic via ARP or DHCP spoofing, hijacking the local router or a rogue access point. Not more can be done as with these attacks but also nothing less. It looks like that the software comes with some nice attacks which modify unencrypted HTTP connections to access different sites in order to poison the browsers cache with heavily used scripts (like a poisoned google analytics etc). Since many sites include such third party code and such code gets access to the full page a poisoned code can extract lots of useful information. But again, this works only for HTTP not HTTPS.


  Is the general population at risk, or only a very specific subset (os,browser?)


Most current systems are at risk but the attacker needs physical access.


  What exactly is at risk, your data, your gmail account ...?


Sniffing and modification of unencrypted connections. Gmail usually is encrypted and thus not affected.


  Is it something that most people can pull off, or does it depend on specific hardware and a high level of skill?


It needs special hardware and software but the hardware is cheap and the software released. It needs about the same level of experience as attacks like ARP or DHCP spoofing, i.e. script kiddies could do it.


  Is there something that one can do easily, without closing all browsers or turning off the pc each time when you walk to a different room to ask a short question. (Is locking it sufficient?)


The usual protections against other USB based attacks still work, i.e. disable USB or restrict the kind of devices. But note that if the device has an ethernet port you could mount a similar attack through this since any kind of wired connections is preferred to wireless by most systems.
