Quote from: notsoshifty on September 27, 2014, 05:11:15 AM

Quote from: MMXIV on September 27, 2014, 03:03:40 AM

Well, the code is solid. That's for sure. The entire point is that over 60% of the network has put their coins into offline staking. I'm just looking for other opinions on where and how an attack could be successful since a vast majority of the network is on a legitimate staking schedule. This gives us a very high level of blockchain security

I guess what we are concerned with is either an attack we are vulnerable to or third party peer validation that our blockchain is entirely secure

"Offline Staking" is a centralised solution to the problem of people not wanting to run their clients 24x7, and it suffers from at least two clear issues:

1. The private keys of all accounts that are being offline staked are in the hands of one central body. The coins are therefore vulnerable to being stolen through external hacks, or the operator can simply run away with the funds. As such, this is similar to keeping them on an exchange. Exchanges have been hacked in the past (it's not possible to completely prevent this, no matter how secure people say their servers are), and exchange operators have run away with funds in the past.

2. Blockchain security in decentralised PoW/PoS systems is dependent upon no person (or group of people working together) having 50% of the hashing/staking power. If you have the private keys to 60% of the coins, you can execute a double spend attack whenever you like.

Of course, it can be argued that if you performed double spend attacks regularly, or ran away with all the coins, they would suddenly become worthless. And with the market cap as low as it is now it's probably not worthwhile to do so. But if it were to increase to, say, $1million, then an offline staking operator could probably get away with a decent amount in a one-off sell, and wouldn't care about the coin's subsequent value.

Virtual offline staking in its current form, requiring trust in a central body that operates the blockchain, is fundamentally against the point of crypto currencies. I think you'll have a hard time persuading people outside of the MMXIV world to take it seriously.

The private keys aren't stored or saved. Once the private keys are loaded they are never checked again. When you use an exchange, you use their Private Key. When you stake with us, you are using your Private Key, not your address. So yes, it requires trust in me to handle it from the submission to the entry, but after that it will be very, very hard to even figure out where they are held. I've proven I am trustworthy by sending out several thousand dollars worth of miners for our raffles

Again, exchanges require you trust them without having the Private Key for yourself. You simply use a rented address. With us, you still have the Private Key, which means you could use that, combined with the address, for cold storage that continues to stake. Exchanges also do not stake if they are smart and using proper cold storage

The staking clients are on nodes that only connect to the seednodes and reject untrusted nodes across the network. They are only visible to mainnet in a second tier of IPs. The peers of the peers is the only way they are even seen and you won't find the IP of any of the staking nodes in your peerlist. If they do try to connect, they will appear as rejected, much like if it was it was a node from another blockchain being kicked out. We do not control all of these nodes. They trust explorers, multipool, exchanges, and other trusted peers

Over 60% of the network is now staking, spread across many, many nodes, which means you can't even buy enough on an exchange to attack it. There is no Proof of Work to utilize for an attack, either

Using us requires less trust than sending your coins to an exchange. To opt out, all you have to do is move coins to a fresh address