https://download.wpsoftware.net/bitcoin/new-pos.pdf
Quote
It is possible, by requiring stake to be bonded for many consecutive blocks, and by choosing signers
using randomness extracted by long-past (in blocktime) blocks, to force the attacks described above
to rewrite long stretches of history. This is often described as “preventing short-range attacks”.
It is clear that this does not address the costless simulation issue; after all, if it’s easy to change
history, it’s easy to change long stretches of history. However, proponents argue that since for
an honestly-created history, long stretches of blocktime correspond to long stretches of real time,
any revision of so much history is sure to contradict the history as remembered by participants in
the system. Thus such an attack would be detected, recognized as an attack, and the new history
rejected.
If this is implemented correctly, there is no problem with this, except that it changes the trust
model from that of Bitcoin. New users who encounter multiple histories are no longer able to
distinguish them on their own; they need to ask existing participants in the network (which may
include friends and family, large corporate entities with reputations to maintain, public websites,
etc.) which history they know to be the true one. This is not a distributed consensus! It is a different
sort of consensus, which may be formed amongst always-online peers in a decentralized way, but
depends on trust for new users and temporarily offline ones. It is correspondingly vulnurable to
legal pressure, attacks on “trusted” entities, and network attacks.
using randomness extracted by long-past (in blocktime) blocks, to force the attacks described above
to rewrite long stretches of history. This is often described as “preventing short-range attacks”.
It is clear that this does not address the costless simulation issue; after all, if it’s easy to change
history, it’s easy to change long stretches of history. However, proponents argue that since for
an honestly-created history, long stretches of blocktime correspond to long stretches of real time,
any revision of so much history is sure to contradict the history as remembered by participants in
the system. Thus such an attack would be detected, recognized as an attack, and the new history
rejected.
If this is implemented correctly, there is no problem with this, except that it changes the trust
model from that of Bitcoin. New users who encounter multiple histories are no longer able to
distinguish them on their own; they need to ask existing participants in the network (which may
include friends and family, large corporate entities with reputations to maintain, public websites,
etc.) which history they know to be the true one. This is not a distributed consensus! It is a different
sort of consensus, which may be formed amongst always-online peers in a decentralized way, but
depends on trust for new users and temporarily offline ones. It is correspondingly vulnurable to
legal pressure, attacks on “trusted” entities, and network attacks.
I don't recommend anyone trust their funds to any network using Proof of Stake. Actual methods of attack are published in this paper. It's just a matter of time.