Good catch. Mario actually provided a marketable quote via email (signed and all). Although that quote is intended as a one-sentence summary of Mario's report,

Good catch. Mario actually provided a marketable quote via email (signed and all). Although that quote is intended as a one-sentence summary of Mario's report, it's not strictly a quote out of the report as much as it is strictly a quote from Mario. Therefore, the source on the quote might more accurately be attributed as "Mario Heiderich in summarizing the Cure53 pentest report." The thinking there was that there wasn't a good way to quote any single part of the report without introducing unnecessary and/or fishy ellipses, because although the point of the rest of the conclusion is that it confirms the claim made by Cyph, there wasn't a readily available standalone sentence in there which could go on the front page. Background: I advised Cyph on AppSec topics on behalf of Mach37 as a mentor, and I helped coordinate the Cure53 pentest. I'm the one who sourced the quote. Give me a few moments (or days; we'll see) for me to find a good way to publicly and non-repudiably present the exact source of the quote. Edit: Signed statement: http://pastebin.com/HcL5bneg http://pastebin.com/HcL5bneg Key: https://keybase.io/cure53 https://keybase.io/cure53 Hat tip to Mario (https://twitter.com/0x6d6172696f https://twitter.com/0x6d6172696f)