Um, no-one? It's below the minimum.

A 51% attack today would cost under $100m. That's easily affordable by a lot of entities. For comparison, HSBC recently lost over $4,000m in fines for their illegal activities. $100m would be peanuts for them. And that's just a bank. If Russia wanted to retaliate for economic sanctions over Ukraine (estimated to be worth billions), or North Korea wanted to cause problems, or China decided it was serious about wanting to stop its people using Bitcoin, or... any number of entities could do it.

See YouTube.

To be honest I think proof of stake is still half-baked. The NXT guys seem excited by "transparent forging", meaning that everyone gets to know who mines the next block, and that seems like an invitation for a denial of service attack. So it has its own issues, which need to be resolved.

The kind of attack that concerns me is someone spending $100m or so on new hardware, not part of any pool, and thus gain over 51% percent. They then private mine empty blocks until they have a chain say 3 hours long. Then they publish it. At which point, all the transactions in those blocks, some of which had 18 confirmations, suddenly have zero confirmations. They all become vulnerable to double-spend attacks by their original senders. The attacker continues mining blocks, now including any double-spends. They do this once a day, at random times, from different IP addresses, for the next six months.

(Instead of empty blocks, they can fill them with artificial transactions. They can mix in real transactions to make the bad ones harder to detect. It can probably be done for cheaper than $100m; but $100m would be cheap enough for a government or bank.)

Abandoning Bitcoin to a spin-off would be one solution. A bit extreme, though. Lots of people would still lose out because of lost transactions. People who bought coins for fiat and then didn't get their coins because that transaction happened after the spin-off took its snapshot.

Well, the value of bitcoin also increased tenfold, so the fiat fee remained about the same. More importantly, the fiat value of the block reward increased the same way. So for the crisis to be averted, we have to hope that Bitcoin continues to grow tenfold every couple of years. I'd rather not have to rely on that.

I believe it is increasing. The more successful Bitcoin is, the more worthwhile attacking it becomes, for terrorists, enemy countries and other interested parties. The goal would be to destroy it, by destroying trust in it, and also to disrupt the lives and finances of everyone who uses it. If that happened today, relatively few people would be affected (and everyone else would laugh, as they did at MtGox). If it happens after another 5 years of Bitcoin growth and success, a lot more people will be hurt.

They'd be right, too. I am also concerned about mining fees. Proof of work means there is an arms race between miners to gain ever-greater hash power. That hardware is expensive, and the arms race means the cost of mining keeps rising. Currently most of that cost is met by the block reward (ie, inflation). As the block reward halves, either transaction fees increase to compensate, or else mining becomes less profitable. If the latter, and it leads to miners dropping out, then we become more vulnerable to the 51% attack again.

Well, for mining to continue at current profit levels, the halving of the block reward has to be balanced by increase in total transaction fees. I'm not sure the growth by 2017 will match the loss of 12.5 BTC per block then, unless transaction fees increase a lot. I am wondering if we will have some kind of crisis then.

The goal would be to destroy Bitcoin. I don't think they'd bother now, but as it becomes more successful it becomes more of a target, until (in my view) a large attack is inevitable.

Why do you think Bitcoin could be revived afterwards? Why would there even be an "afterwards"? Once they've bought the hardware, they can continue the attack indefinitely, for only the cost of electricity. They don't even need to run it continuously. They could, at random times, release a few hours of privately mined forked chain. That would be enough to make the system almost unusable.

By "the government", are you thinking America is the only threat? What about terrorists? As an attack on financial infrastructure, it would have similar symbolism to the 9/11 attack on the World Trade Centre. (How can you get more "world trade" than Bitcoin?) It would avoid the negative publicity of civilian deaths, and avoid the need for them to risk their own deaths. Alternatively, Russia might do it in retaliation for economic sanctions imposed on them, eg over Ukraine. Or China, or any country that has currency controls. Or a private bank. HSBC recently paid over $4b in fines; $100m would be easily affordable to them.

ASICs will plateau, but the block-chain reward will also decrease, and I don't think transaction fees will rise quickly enough to compensate, and nor will the volume of transactions. So we may find that existing miners keep going, because their ASICs are good for nothing else, but few new miners will want to get involved because they'll never cover their capital costs. And while the attacker is attacking, the miners could be mining zero blocks.

I'm having trouble getting a NXT install working. Sorry if this is the wrong place to ask, and feel free to direct me to somewhere better, but all my searches have found only useless or outdated information.

I'm running Windows 8.1 Update. I've installed from http://www.nxtcommunity.org/nxt-coin/install-nxt-software-your-computer, to my Program Files. When I run run.bat a console window pops up for a few seconds and then disappears again. Enough happens that I'm pretty sure it has found Java and is executing. I tried editing the batch file to add a pause at the end, but all that gives me is "Press any key to continue...". It seems Java is running in a different console window to the batch file.

Also, when I navigate to https://127.0.0.1:7875 in Firefox, NoScript has a hissy fit. When I click Options, it shows me an ABE (Applications Boundaries Enforcer) panel. I'd rather not disable ABE or NoScript entirely. I have no idea what I'm supposed to click to enable NXT only.

I have to say, my first impressions of NXT are very poor. Even the suggestion I found to edit the run.bat was hard, as Notepad refuses to save it. I had to save it to a different directory, and then move it to the right place manually.

Part 2 is more interesting. I hadn't realised that if a 51% miner secret mines empty blocks for 6 hours and then releases them, that would reset all transactions in those 6 hours back to zero confirmations. That would allow double-spends on all those transactions to be attempted, not by the miner (who doesn't know the private keys) but by whoever initiated the original transactions. The miner could then continue mining in public, accepting transactions, but given preference to the double-spends. Basically it would be a lot worse than Bitcoin being offline for 6 hours.

The idea that this could be countered by looking for long chains of empty blocks is surely wrong. The attacker could fill them with their own, dummy transactions.

I'm not so sure about his claim that the miner could be mostly honest, and accept 99% of transactions but exclude ones for Overstock. That kind of targeted attack would require knowing which transactions were Overstock's.

It's a long-winded estimation of how much it would cost to acquire 51% of Bitcoin's hash power. With some explanation of why it matters and where the numbers come from.

And Walmart offers ubiquitous stores and ease of use. What struck me as interesting is that it shows there is demand there for money transfer services, even in the US where credit cards are common.

Nothing, especially if they do it off-chain. Doing it on-chain would mean a change to the protocol, at least in how bitcoin values are interpreted.

The difference is that the value of 1 BTC does not change when you sub-divide it, but it does change if you create more coins. Creating more coins is inflationary; it erodes the value of savings. Sub-dividing them isn't. A saver who owned 1,000 satoshi will end up owning 1,000,000 milli-satoshi and their wealth will be the same.

Hence creating more coins is controversial and will probably never happen to Bitcoin, but creating fractions isn't and probably will, if it ever becomes necessary.

Inflation encourages savers to invest their money rather than just stuffing it under a mattress; they need to get an interest rate of at least the inflation rate, or else the value of their savings will erode. Investment is claimed to be good for the economy. It means people getting paid to do stuff, rather than there being no jobs and no production or consumption.

Governments can manipulate the economy to some extent by adjusting interest rates, and making it easier or harder for people to borrow. There's a limit to how low interest rates can go because they can't be negative, but increasing inflation by 1% has a similar effect to decreasing interest rates by the same amount, and so a steady rate of inflation of around 2-3% gives them a bit more flexibility.

Obviously not everyone agrees with the above, especially in Bitcoin circles, but I believe it's the mainstream economics view.

I think a kind of reverse Gresham's Law will apply. In other words, a merchant given the choice between bitcoin that will appreciate in value, and an altcoin that will depreciate, will prefer bitcoin.

(Gresham's Law says that bad money drives out good. As far as I can tell it only applies to fiat money, where the merchant is legally required to accept the bad money because it is government-mandated legal tender. If the merchant has a choice, they'll reject it or only accept it at a premium.)

As others have said, many things of real value are imaginary. (Although "virtual" might be a better word.)

Bitcoins are valuable for the same reasons that gold is valuable: both are rare, difficult to forge, and enable trade. Depending on how ignorant the person is, you might need to explain how the block-chain acts as a public ledger, recording ownership; some people think of coins as magic numbers and don't understand that the ledger saying who owns what is crucial. It's no more imaginary than a bank account.

Then explain how anyone can update the ledger, but only by following a protocol using digital signatures, making it impossible to cheat and spend other people's coins. The really clever bit is in how two valid but conflicting updates get reconciled, but frankly that's so esoteric you may not need to mention it unless they ask.

Then go back to how there is value in trade. If you bake 10 loaves of bread, you've created some value, but they'll go stale before you can eat them all, so you create more value if you sell some of them. So markets help create value. The internet is a marketplace par excellence, but it needs a currency which is global, efficient, open, and free. Credit cards don't quite hack it. You might want to explain about "permissionless innovation" if you think they might be receptive to it, and how other protocols can be layered on top of bitcoin's definition of ownership much like HTTP is a layer on top of TCP/IP. Currency is merely the first application.

Ultimately the proof of the pudding is in the eating. The fact that bitcoin still hasn't crashed, despite all the recent bad PR, shows that a lot of people believe it has enduring value.

The problem is that we won't know which transactions are theirs, so every transaction becomes suspect even if only a small number of transactions are directly affected.

If they throw their weight behind Bitcoin or an altcoin, whichever they choose will get a boost. If they start from scratch, they'll have the same problems all altcoins have, of getting anyone to care. The only way I can see it working is if their new coin is technically brilliant, and even then it's dubious. (Lots of altcoins seem technically better than Bitcoin to me, but they don't have much momentum.)

Although that's true, most of their own services are free. They can't get the ball rolling by accepting the currency themselves because most of us don't pay them anything. I think being endorsed by Amazon would be a bigger deal than being endorsed by Google.

Their resources could even count against them. We know they have huge server farms, so if their own coin is mineable by them, they could mount a 51% attack against it. It'd risk being treated as a private currency rather than a distributed one.

That's a big "if". They have a lot of internal projects that never see the light of day, and a lot of the ones that do are half-baked and/or get dropped. They are not above having two operating systems - Android and Chrome OS - in the same mobile space.

Overall, I think Google and companies like them are far more likely to endorse bitcoin than create their own altcoin.

While it's true that bitcoin miners might want to switch, they are in the same boat as the attacker: their ASIC hardware is no good for the altcoin. So the hashrate of the altcoin will be much lower. Also, for non-ASIC currencies the attacker could probably rent cloud servers from Amazon or someone, so the capital cost of an attack would be lower.

Acknowledged. My real thought here is that many of these storage options seemed designed to outlast their owners. As such they should perhaps be self-contained and not rely on a password stored within a fragile skull.

(Actually, some of them seem designed to outlast the internet.)

Really? If I transfer 100 BTC to a new brainwallet, how does anyone know that the address is a brainwallet that is worth attacking? Are people attacking every address that has significant funds?

He made it sound more expensive than I expected. There was an Ars Technica article about a miner which implied $60m might be enough. I guess that's because it does change with time. He does mention it being cheaper a few months ago.

Part of Bitcoin security comes from it being more profitable to use the 51% to mine for honest block rewards than to attack Bitcoin. Perhaps he'll address that point in the second video.

If you can remember the password used to encrypt the private key, who not just make the private key the SHA256 hash of the password? Then there's no need to store anything.