Actual paper[1] from the author's blog post[2].
[1]: http://sviehb.files.wordpress.com/2011/12/viehboeck_wps.pdf
[2]: https://sviehb.wordpress.com/2011/12/27/wi-fi-protected-setu...
[1]: http://sviehb.files.wordpress.com/2011/12/viehboeck_wps.pdf
[2]: https://sviehb.wordpress.com/2011/12/27/wi-fi-protected-setu...
Anyone from Cisco know? Or have the equipment/effort able to verify this claim: That "Manual" switch only affects the GUI, if you look at the beacon (with some WiFi Analyzer) you will notice that WPS is still enabled.