Not sure why all the downvotes, this seems to be mostly true - although this is more advice for site/domain admins rather than users themselves.

There may be some caveats, such as an otherwise secure site using https, except for using regular-http redirects (which the PosionTap device could intercept) without using strict transport security with preloading.

Not if the tap is pretending to be a keyboard and injecting keystrokes into your input stream. Make it a compound device, keyboard, mouse, and network port and you're kind of off to the races.

For certain values of safe.

Poisoning the DNS subsystem of your computer is not safe. At the very least it could record which requests you made indefinitely. This does need to be fixed.