I've also read that if you have the pin, you can get the password even after WPS is turned off, which means it's a permanent pwn.

Random comment I read somewhere, so may not be reliable.