I'm not surprised in the slightest that they're doing it again.

I feel dirty saying this, but I'm with GoDaddy on this one. It might be a violation of ICANN regulations, but it's also a really important step for protecting against domain hijacking.

This "feature" didn't do anything to prevent the theft of css-tricks.com[1] and other domains, because why should someone who wants to steal a domain first change the contact information. Two-factor authentication would provide real protection, but that is $25/year at Godaddy.[2] It's like mobile phone carriers: They have the technical means to block stolen phones from ever accessing the network again, but why would they do that, since every stolen phone equals a new sale?

1: http://css-tricks.com/this-sites-domain-is-now-safe/ 2: https://www.godaddy.com/domainaddon/protected-registration.a...

There is no way to shortcut this procedure if you are the legitimate domain owner. If you use a privacy guard to avoid publishing your name/address, then you will run into this issue:

You aren't allowed to transfer your domain away while the privacy guard is in effect, so you'll need to change your contact information. Bam! This triggers the instant 60-day lockout, during which time your full contact information is visible.

Besides, if I already have your account compromised, I probably have your email, that's how they are linked in the first place. It wouldn't be too hard in most systems to just initiate the transfer and hide that info from the user, or simply lock them out of their email. You think their domain registrar is the first place they will call when their email stops working? HELL NO. They have bigger concerns.

They are using a special email address for whois stuff? How often you think they check that? Most people, not all that often. If I didn't subscribe to updates on my whois info from a third party, I wouldn't notice either, and it's my damn job.

We can't implement mindless policies to 'protect' people from themselves unless there are real tangible benefits to it and it's not simply self-serving. Of the major registrars, GoDaddy is the only one I know of implementing this policy and they've been hijacked numerous times. Their whois privacy even had a hole in it for years that is now fixed. It's not stopping the hijackings. Other registrars without that policy have better track records preventing domain hijackings.

Yes, actually they would. Or more likely, they intend to, only have small time slices and take weeks or months longer to leave.

Aggregated across millions of subscribers, and this adds up to big $$$, some of which can pay a high-priced spokesmodel to defray a large amount of the downsides.

"we suspect that this competitor is thwarting efforts"

"GoDaddy appears to be"

Suspect, appears to be... none of these are exactly definitive terms.

The actual transfer process can be nearly instant given the EPP code and the registrar's permission. What happens in between is somewhat fuzzy and I am not sure there are clear rules on how each company handles it. The longest I've seen (that I recall) is 7 days, but I could be wrong.

NameCheap is no more capable of knowing GoDaddy's inner workings than we are. They can only tell us what they're seeing and draw logical conclusions from those things.

Let's be a bit less in a hurry to sling around accusations of astroturfing, OK?

Seriously people, this isn't medieval mob justice. We're not burning down a widow's home. Worst case scenario if we're wrong is a few stock tickers dip for a few days. Cut it out with this "omg mob justice" shit.

Good going, detective, now that you've outed me, I'll lose my job, and who will feed all of my 58 children?

Seriously, though, I have no connection with GoDaddy, I'm just very sceptical of the "GoDaddy will attempt to repair their reputation by actively making life harder for people who already don't like them" idea.

Sure, they may well be playing games to attempt to make it too hard for people to leave, but I think that it's much more likely that they have rate-limiters, and anti-spam/fraud protection working against mass migrations away from their service. If that's the case, I can't see them being in any particular hurry to fix the problem (or to even see it as a problem), but that's not the same thing as actively slowing down the process.

They have nothing really to gain by being malicious at this point, and plenty to lose (internet lynch mobs being easy to rile, as they are). Let's just put the pitchforks down for a little bit until we're certain that GoDaddy is really deliberately throwing spanners in the works.

Once you're certain of that, then by all means, go hog wild with your iNoose and your PitchFork 2.0. Until then, keep an eye on it, but let's not jump to stupid/hasty conclusions.

I'm not jumping to any conclusions. I could very easily see by way of whois lookups that 4/5 of my domains had their contact records REMOVED from the whois entry, and stuffed off in a supplemental url provided in the whois record, which required a captcha defeat in order to access. This simply doesn't follow the ICANN whois spec.

I'd say you're doing a lot more speculation than the people on this thread who have been impacted by GoDaddy's ongoing slimy behavior.