A custom built machine can break all these unused accounts with money in it (but have never been used to send transactions) with a week
Show us the math.
64-bit is only 8 times stronger than 56-bit.
256 times.
It''s irrelevant whether algorithm is DES or BBC or NBC or ZZZ ... the attack is brute force.
It is relevant. To estimate the amount of time needed to compute something, you don't simply estimate the number of operations (2^64). You also estimate the time needed per operation. Show us your estimates.
You make a claim, that
If you don't understand that 2 ^64 is small number for 2014 security demands, then you need more help than I can offer
The burden of proof of that claim lies with you.
Earlier Jean-Luc posted an estimate of 8000 per second based on his Java van-gen. (Sorry, I don't have the post handy to quote). But that's a bad estimate, an attacker is not going to be generating addresses using Java! In practice, it will be much higher.
A lot of what's in the protocol seems dangerous for casual users. That's how I felt at first too. But as I understand it now, the design philosophy is to keep the protocol clean. Protections are then placed at the client level instead, to prevent people from screwing things up. I've been helping with some of these (e.g. future account numbers will have a different format, with error detection and correction). It's just at the current stage of dev, folks aren't seeing all these client-level protections yet.
Ultimately, the purpose of only 64bit protection for accounts without outgoing transaction is to allow nxt owned by folks who got in early, but don't have any real interest in it (e.g. they just saw it as another free crypto being given out in a giveaway thread) to be recovered in future, rather than forever be inaccessible. There's still plenty of time (imo, even months is plenty of time) for folks to secure their accounts before their nxt is at any real risk.
Someone might just invest a few thousand dollars, never send a transactions, and that account then is open to brute forcing 64-bit
Yeah, that's an additional risk one would have to accept, if one invested without doing their homework. It used to be clear that this is beta software with a lot of risks, but I think the marketing side has gained a lot of steam lately. But we're not trying to scam people. This is an unfortunate side-effect of our decentralized organization (which again should be clear to anyone who did their homework before buying in).
...We are actively trying to educate people of the risk of not having any transaction associated with an account....
so just dont let it sit like that
If you are doing it actively, then good, but I found out about it only in this thread. I have been to official site. Saw nothing about it on main page or in their forum.
I've been writing wiki pages on how to verify the SHA256 checksum and how to choose secure password. IMO these are greater priority that 64 bit address collisions, since nxt has been stolen due to spoofed clients and insecure passwords, but I've not heard any report of nxt lost to address collision.
My time and energy are limited (and I haven't received a single nxt for my work so far). Personally, I've found the education about this sufficient (in proportion to the risk). I've also found it to be not a big deal yet. I let my (at the time) ~250 USD worth of nxt sit for many weeks in an unprotected account, with full knowledge of the situation and consequences, before I registered an alias and secured it.
If you feel that this issue needs more attention, you could help us by editing the wiki, or telling the webmasters, increasing awareness of this issue through other means
