The three major problems with WPS are: (1) it requires only an 8 digit pin (10^8 is a small keyspace), (2) one digit of that pin is a checksum (hence 7 independent digits and 10^7 pins to check), and (3) the first group of four digits is checked independently - that is you need to only check at most 10^4 ~ 10000 pins to break the first group of four digits; and then 1000 to check the second group (since you know one digit due to the checksum). And really the expected number of attempts is half that; so on average only ~5500 attempts are needed.

WPS slightly mitigates this by mandating that you are locked out for 60 seconds after three consecutive bad attempts. Originally, not all WPS routers enforced this timeout (very bad even without vulnerabilities 2 and 3; checking at a rate of 10 per second; means you can break your neighbor's router in a few months). Some manufacturers will increase this timeout on subsequent failures, which is good. Note the three attempts = 60s timeout is not a panacea; e.g., will take 3.82 days on average (and at most 7.64 days) to crack into your neighbors WPS enabled router. Granted exponential timeouts could mitigate brute forcing; however how these timeouts are implemented is important. (E.g., if the attacker changes their wifi mac address on each attempt will they continue to be blocked out? Otherwise can you use this to DoS WPS connections?).

Now to answer your question: CERT (last updated May 2012) is "currently unaware of a practical solution to this problem" and recommends disabling WPS.

Also while there are rumors of a new WPS 2.0 standard eventually coming out, especially in the responses to this vulnerability. Hopefully, this fix would not let an attacker know if they've found a portion of the key and hopefully would require all digits to be independent instead of having a worthless checksum. However, the wifi alliance page on WPS doesn't mention this at all (e.g., the last press-release on WPS is from Feb 2008) unless its in one of the standards that cost $100-$200 to purchase. Standards tend to change slowly as it requires both the software and hardware end of the client and router to be fully compatible (and backward-compatible).

Granted, I'd expect nowadays more WPS enabled routers to implement the 60s + exponential timeout, but still would never recommend for anyone to use WPS.

The three major problems with WPS are: (1) it requires only an 8 digit pin (10^8 is a small keyspace), (2) one digit of that pin is a checksum (hence 7 independent digits and 10^7 pins to check), and (3) the first group of four digits is checked independently - that is you need to only check at most 10^4 ~ 10000 pins to break the first group of four digits; and then 1000 to check the second group (since you know one digit due to the checksum). And really the expected number of attempts is half that; so on average only ~5500 attempts are needed.

WPS slightly mitigates this by mandating that you are locked out for 60 seconds after three consecutive bad attempts. Originally, not all WPS routers enforced this timeout (very bad even without vulnerabilities 2 and 3; checking at a rate of 10 per second; means you can break your neighbor's router in a few months). Some manufacturers will increase this timeout on subsequent failures, which is good. Note the three attempts = 60s timeout is not a panacea; e.g., will take 3.82 days on average (and at most 7.64 days) to crack into your neighbors WPS enabled router. Granted exponential timeouts could mitigate brute forcing; however how these timeouts are implemented is important. (E.g., if the attacker changes their wifi mac address on each attempt will they continue to be blocked out? Otherwise can you use this to DoS WPS connections?).

Now to answer your question: CERT (last updated May 2012) is "currently unaware of a practical solution to this problem" and recommends disabling WPS.

Also while there are rumors of a new WPS 2.0 standard eventually coming out, especially in the responses to this vulnerability. Hopefully, this fix would not let an attacker know if they've found a portion of the key and hopefully would require all digits to be independent instead of having a worthless checksum. However, the wifi alliance page on WPS doesn't mention this at all (e.g., the last press-release on WPS is from Feb 2008) unless its in one of the standards that cost $100-$200 to purchase. Standards tend to change slowly as it requires both the software and hardware end of the client and router to be fully compatible (and backward-compatible).

Granted, I'd expect nowadays more WPS enabled routers to implement the 60s + exponential timeout, but still would never recommend for anyone to use WPS.