Originally posted by TheBansche
Also Registrar-Lock just means nobody can order the Registry to make changes to the whois information or DNS without special permission fro the Registrar of record. The way it works with dot-us (as I recall) is you need a special code to unlock the domain so it can be modified at the registry or transferred.
Yup, .INFO, .BIZ and .US work differently from Verisign's .COM and .NET. The transfer for the former can only be triggered if you have access to the 'transfer authorization code' which is set by the current registrar.
God help you if you a person breaks into your account at eNom since the transfer authorization codes can be viewed at the bottom of each domain detail. That facilitates convenience, but the only thing standing between you and the thief is your username and account password.
I would gladly pay big bucks for eNom to introduce another security layer to hide the authorization code with another password protect.
Of course, not all registrars let you see your authorization codes immediately with your domain details. Netsol has a very tight system that makes getting those codes a nightmare. I guess Netsol's Archilles Heel is probably it's disgrunted employees, and there is no way you can really protect yourself against insider jobs, except if you (1) seek public notary of the domains you own through lawyers that will verify a title deed and (2) ensure you have a physical record of all the transactions you have done with your registrar. As a rule, personal screencaptures of your account should be mandatory. This should all be forwarded to your lawyers.
Domain thieves and hackers prey on identifying the weaknesses in your system - the primary one being the admin email address. So free emails are a total no-no. You must own that domain.
If you are serious, make sure you register the domain of that email address to its max i.e. 2013 is the limit right now.
But NEVER put the the admin email of that domain using the email of that domain. Register another domain specifically for that purpose, and do the loop above. To be really serious, repeat the loop with yet another email address for the former.
One of the best defenses is, of course, to make that domain well known - so development is key and you have many witnesses. Anyone who tries to steal Microsoft.com, is probably a psychotic suicide personality.