As the author of the quoted article noted himself:
Originally, I thought that this problem was fundamental, but in reality it’s an issue that can be worked around. One solution, for example, is to note that every block must have a timestamp, and users reject chains with timestamps that are far ahead of their own. A long-range attack will thus have to fit into the same length of time, but because it involves a much smaller quantity of currency units its score will be much lower.
So your conclusion about the impossibility of the 'secret chain' with only 1% stake outpacing the main chain is correct, given that the clients validate the block timestamps (they can't go too far into the future).
The term Long-Range Attack can refer to different things depending on the cryptocurrency and the chosen algorithm. The formula that you included in your question
hash(kernel) ≤ target × balance of UTXO
doesn't apply to Ethereum and Casper as there is no UTXO there.
The Preprogrammed long-range attack described in the NeuCoin whitepaper that stems from the fact that the stake modifier of a given stake is static and due to the use of coin age in the mining equation, doesn't apply to Ethereum either.
I am by no means an expert in PoS but I'll try to outline the logic behind the Long-range attack described in On Stake by V. Buterin that will work even with less than 50% stake on 'non-secret' chain:
- If we are given the simplest PoS algorithm where every account has a certain chance per second of generating a valid block. This chance is described with the formula:
SHA256(prevhash + address + timestamp) <= 2^256 * balance / diff
"There is nothing at stake" problem: a rational miner will choose to mine on 2 chains or more whenever there is an opportunity, to maximise his expected value.
- Miners who mine only on single chain are called altruistic. Miners who mine on as many chains as they can (rational) are called non-altruistic.
- An attacker only needs to outpace altruistic miners to perform an attack, thus it's possible to perform this attack even having less than 50% stake (as long as non-altruistic miners' and attacker's stakes add up to 51%).
To overcome this issue the Slasher algorithm can be used. If a miner creates a block on 2 chains he will be punished. For that, anyone can submit the block from the other chain into the original chain in order to steal the mining reward and penalize the double-voter.
- Miners will have to make security deposits so there is way for penalizing in case of double voting
- The miner has to have the right to withdraw the security deposit eventually, and once the deposit is withdrawn there is no longer any incentive not to vote on a long-range fork starting far back in time using those coins (reference). E.g. after 1000 blocks the miner will have the right to withdraw his deposit.
Long-range attack is when a miner starts mining a sidechain 1000 or more blocks back.
- Other non-altruistic miners will mine on that chain too since there is no punishing and the expected value is higher.
- In fact, it's even expected to see a black market of people selling their old private keys, culminating with an attacker single-handedly acquiring access to the keys that controlled over 50% of the currency supply at some point in history and performing the attack (reference).
The solution as the author noted is to introduce a rule into each client not to accept forks going back more than 1000 blocks. The problem is, however, what happens when a new user enters the picture. Then he considers hybrid PoW/PoS and social graph systems as a possible solution.
With the finality gadget described in the Mauve Paper:
even majority collusions cannot conduct medium or long-range 51% attacks without destroying all of their ether.