So I recently learned about domain name locking after having found the *.co domains of a top web site weren’t protected against server and client updating/transfering. (while the .co tld offers all registrar locking protections)
As the answer of that question wasn’t descriptive on wheather this depict a real threat, I finally reported the issue to their security team (plus an another bug that might enable to perform the theft from their own registrar website).
However, came up the killer’s question from their part :
how would it be possible to update contact details ?
I don’t have even an idea of the involved protocols in such registrar transferring…