When you are trying to use a blockchain as a store of value or currency, as Bitcoin does, then the cost of Proof of Work mining may be acceptable for the reasons you mentioned.
However, being used as a currency is not the only thing that a blockchain can do, and many newer crypto projects are attempting to do other things. For example, you can use a blockchain to act as a company (a ‘Distributed Autonomous Company’, or DAC). The DAC can provide services to users, in exchange for fees, and attempt to make a profit. For example, the Bitshares project functions as a company that provides an exchange on the blockchain, in which you can trade assets such as gold, dollars, bitcoin, etc.
When you are attempting to run a company on a blockchain, profits matter, and that means that you need your fees generated from customers to exceed the cost to secure the network, and that means that you need to use a more efficient security algorithm than proof of work. Various Proof of Stake algorithms cost much less to maintain. If the goal of your blockchain is not to represent all of the money in the world, but rather to be an autonomous company performing a certain service to users, then maybe you do not need to go 100% all in on security, perhaps it makes more sense to try and make a profit using a cheaper consensus algorithm.
Finally, there are now a variety of different Proof of Stake algorithms. Not all of them suffer from the vulnerabilities of the original proof of stake, in which you can use old keys which used to control many coins in order to attack the network. For example, Ripple (Ripple Consensus algorithm), Bitshares (Delegated Proof of Stake), and NXT (Transparent Forging) algorithms do not suffer from this weakness, as far as I know.
Full disclaimer: I work for Vitalik and the Ethereum Research Team.
Here are a couple of reasons for why we are ultimately eschewing PoW:
(1) We are pushing to get blockchain updating down to 3 seconds. You really can’t do this with PoW, since 3 seconds is our budget for our network overhead.
(2) A single block chain doesn’t scale well—we’re pushing for protocols that involve multiple blockchains processing transactions independently. The current proposals all rely essentially on PoS based on the central Ethereum Blockchain. Proof of Work isn’t generally secure for these architectures—if a new blockchain was created then a botnet could easily gain 51% of the compute power for a while before hashing power could be directed from other parts of the network.
When you are trying to use a blockchain as a store of value or currency, as Bitcoin does, then the cost of Proof of Work mining may be acceptable for the reasons you mentioned.
However, being used as a currency is not the only thing that a blockchain can do, and many newer crypto projects are attempting to do other things. For example, you can use a blockchain to act as a company (a ‘Distributed Autonomous Company’, or DAC). The DAC can provide services to users, in exchange for fees, and attempt to make a profit. For example, the Bitshares project functions as a company that provides an exchange on the blockchain, in which you can trade assets such as gold, dollars, bitcoin, etc.
When you are attempting to run a company on a blockchain, profits matter, and that means that you need your fees generated from customers to exceed the cost to secure the network, and that means that you need to use a more efficient security algorithm than proof of work. Various Proof of Stake algorithms cost much less to maintain. If the goal of your blockchain is not to represent all of the money in the world, but rather to be an autonomous company performing a certain service to users, then maybe you do not need to go 100% all in on security, perhaps it makes more sense to try and make a profit using a cheaper consensus algorithm.
Finally, there are now a variety of different Proof of Stake algorithms. Not all of them suffer from the vulnerabilities of the original proof of stake, in which you can use old keys which used to control many coins in order to attack the network. For example, Ripple (Ripple Consensus algorithm), Bitshares (Delegated Proof of Stake), and NXT (Transparent Forging) algorithms do not suffer from this weakness, as far as I know.
Full disclaimer: I work for Vitalik and the Ethereum Research Team.
Here are a couple of reasons for why we are ultimately eschewing PoW:
(1) We are pushing to get blockchain updating down to 3 seconds. You really can’t do this with PoW, since 3 seconds is our budget for our network overhead.
(2) A single block chain doesn’t scale well—we’re pushing for protocols that involve multiple blockchains processing transactions independently. The current proposals all rely essentially on PoS based on the central Ethereum Blockchain. Proof of Work isn’t generally secure for these architectures—if a new blockchain was created then a botnet could easily gain 51% of the compute power for a while before hashing power could be directed from other parts of the network.