Bitcoin Forum

Is there anyway to know?

Would definitely inform my decision of where I want to put my money long term.

Is there anyway to know?

Would definitely inform my decision of where I want to put my money long term.

Avoid anything with any element of PoS; more to the point, anything which relies on checkpoints for security.

Bitcoin relies on checkpoints for security. Source: https://bitcointalk.org/index.php?topic=194078.0

No it doesn't. Keep reading that thread.

so that an attacker who has complete control of your network (and thus can prevent you from hearing the longest chain from the honest bitcoin network) from putting you on a fake (low difficulty) isolated chain unless they can also trick you into running replaced software. With the checkpoints such an attacker hast to have a ton of mining power in order to continue the chain.

It does. Is the reason gmaxwell wrote not related to security?

Thats not really what they're for— though that have the effect too. Most of their usefulness is that they prevent a dos attacker from filling up bitcoin node's disk space with long runs of low difficulty blocks forked off low in the chain.

This is a special case of isolating a node from the main chain and feeding it the blocks of the attacker's chain. How is this not related to security?

It's a DOS angle, nothing more. The key distinction is that bitcoin can continue to function with the same level of security with checkpoints removed. If you remove checkpoints from any PoS coin, it immediately becomes vulnerable to any number of attacks on the chain history, for example the keys from the past attack wherein I can produce invalid candidate histories by using historic private keys which are no long in use.

In theory pigs can fly. I can name a number of theoretical attack vectors on PoW coins. They don't make me lose sleep owning PoW coins.

Let's hear them, then.

first I'd like to indicate what you need to successfully accomplish the PoS attack you pointed to.

a) disable checkpoints and have users download your release.

b) procure many PoS accounts keys with very large stakes.

c) have powerful / quantum hardware to build a myriad of chains to get one with the cumulative difficulty higher than the valid chain to be accepted by other nodes.

Now for the theoretical attack vectors on PoW, these are well known but I can't refuse since you asked.

1) voluntary collusion of miners.

2) involuntary - high vulnerability of centralized mining physical infrastructure and known locations to state level attacks.

3) dependence on ever increasing hash rate and difficulty, security is weakened if price goes down, dependence on energy infrastructure.

4) quantum computing.

Checkpoints completely centralise control of the chain, though.

They don't if they are hashes of hard fork blocks, coded into the software thousands blocks after the HF had happened by consensus.


Historical keys have no value, they should be easy to purchase.

There is no proof to this statement.


Since block production is so cheap in PoS, I don't need any such powerful hardware to do this.

Yes, you do. A well designed PoS has protections against this computing attack to notably slow you down.


Yes, 51% attack is well known.


The chain is highly resilient to such takedowns - anyone with a CPU can mine. In PoS, if you confiscate the stake from the stakers, the chain is totally unrecoverable.

a) anyone with a CPU can mine after how many years of difficulty adjustment and dysfunctional network? b) the protection of Bitcoin is ASIC network. If it's degraded to anyone with a CPU can mine, many state level actors can attack the network that had protection by ASICs removed.


Security is weakened if hash rate goes down, not price.

Hash rate follows price. PoW depends on the price going up. If the price goes down, the hash rate goes down, PoW is at risk.


Does not exist.

You can't be sure.

Look, all I am saying is properly designed PoW and PoS have their advantages and flaws. Dismissing one or the other is ill-advised. Hedging your risks using both is wise.

I haven't seen an instance of a PoS chain which didn't rely on rolling checkpoints to prevent against long and short range attacks. If you don't have rolling checkpoints, anyone with historical private keys can re-write history.

Why would an empty private key have any value to anybody?

Rolling checkpoints do not centralize control of the chain, they are a feature of decentralized consensus, what makes them evil in your eyes?

An empty private key may have no value to someone. The problem is you need to obtain a lot of them, the longer you wait the more spread and larger is the hashing stake protecting the network, making your task more arduous, and this is only one challenge you face. I illustrated the other challenges in the preceding posts.

In essence you can't explain why rolling decentralized checkpoints are evil. You know, money is a serious business, fun experiments belong to other fields of life. I think you do a disservice to the OP advising to go all in with one less than ideal technology. Since a perfectly ideal one has yet to be invented, PoW+PoS is a way to hedge bets if one of them goes belly up, from an investing point of view.

I was hoping you'd give me the obvious answer as to why you don't want rolling checkpoints on every block so we could explore the entire reason any kind of rolling checkpoint is bad.

The answer is simple: rolling checkpoints on every block is analogous to having 1 central server giving out the consensus results, which is the same as having no consensus at all. That is the total opposite of decentralisation.

Network latency makes rolling checkpoints going one block deep a nonsense. There is a range of reasonable numbers to pick from for using as a rolling checkpoint depth. A well designed PoS system achieves consensus and doesn't compromise on decentralization with one of these sensible numbers. Discussing ridiculous magic numbers is a waste of time. It's like choosing block time. You wouldn't choose 1 second for block time because it makes no technical sense and can't work. A reasonably safe block time is 1 minute and longer.

It was a thought experiment, not implementation advice. Rolling checkpoints of any interval cause inter block reorgs in order to fit in with the accepted history; this accepted history comes from a central location. How is that decentralised in any way?

What central location do new reorganized blocks come from? Chain reorgs are result of the longest chain rule implementation, picked on the basis of the highest cumulative difficulty.

Not reorganised blocks, the checkpoints themselves come from centralised locations, e.g: https://peercoin.net/faq

Peercoin has centralized checkpoints and is not worthy of mention.

I thought we were discussing PoS with rolling checkpoints.

What are you referring to, give an example?

History Attack

In a history attack, someone acquires a large number of tokens, sells them, and then attempts to create a successful fork from just before the time when their tokens were sold or traded. If the attack fails, the attempt costs nothing because the tokens have already been sold or traded; if the attack succeeds, the attacker gets their tokens back. Extreme forms of this attack involve obtaining the private keys from old accounts and using them to build a successful chain right from the genesis block.

In Nxt, the basic history attack generally fails because all stake must be stationary for 1440 blocks before it can be used for forging; moreover, the effective balance of the account that generates each block is verified as part of block validation. The extreme form of this attack generally fails because the Nxt blockchain cannot be re-organized more than 720 blocks behind the current block height. This limits the time frame in which a bad actor could mount this form of attack.

Nxt and its 720 blocks deep rolling decentralized checkpoints.
http://wiki.nxtcrypto.org/wiki/Whitepaper:Nxt

Those are not checkpoints at all, thats a maximum reorg depth and it doesn't solve the problem:

1. I buy 33% of historical stake private keys together somehow, which are worthless 'now' so should be cheap
2. I generate a longer cumulative difficulty chain starting from before the private keys funds moved*
3. All nodes accept it as the canonical chain
4. End of coin

*) I can do this first time with 100% success rate, no need to permute, since I have 100% chance of generating every block at 33% of historical stake.

If you go by the definition that a checkpoint is something devs code into the software, sure. Nxt calls these rolling checkpoints.

Hear hear, you make all users download your client with no HF checkpoints and obtain a lot of private keys, and generate a heavier chain in 12 hours ramming through the block generation slow-down protections. You're unstoppable.

You don't understand the problem at all.