2) Also, I don't use GMail; say what you will, it's another defense against this.
3) Never, ever enter important credentials to a site you didn't open from a bookmark.
EDIT: Downvotes for effective strategies against this attack? Stay classy, HN. Stay classy.
As the article states, you can use this to replicate any website. It's not just isolated to GMail.
Sure, but most users are careful when they first login to a site like gmail, but then leave the tab open. Mentally, you know you only opened your gmail tabs from a bookmark, so any gmail tab already open must be safe. That's what the attack plays on - you're not on your guard, so don't check the URL.
Using a mail client to get your GMail instead of a web client is a defense against this too.
OP doesn't understand that this kind of attack (or most attacks for that matter) aren't targeted to the sophisticated user, its targeted to the majority of the population. The majority of the population isn't running noscript, is using the vanilla settings that the browser came with (which means javascript is turned on) and doesn't think twice about entering in their credentials into a site that they trust.