When clientTransferProhibited is off to transfer a domain name, couldn't the name be stolen?

Question

I'd like to transfer a domain from one registrar (Key-systems) to another registrar (OVH). I don't really understand the procedure and I'm a bit confused... I read everywhere that clientTransferProhibited prevents people from stealing your domain name.

Now apparently during the course of transferring my domain from Key-systems to OVH, I'll need to change clientTransferProhibited so that the transfer is allowed.

Wouldn't my domain then become "stealable" during some amount of time? (a few hours / days / week)

Answer 1

Even without that setting, there are protections against unauthorized domain name transfers. Here are the six steps required to transfer a domain name to a new registrar:

1. Purchase and request domain transfer at the new registrar
2. Request authorization code at current registrar.
3. Authorization code received from current registrar.
4. Begin the transfer from the new registrar using the authorization code.
5. Email Notification from current registrar.
6. Domain Transfer completed to new registrar

As you can see, there are several checks in place to ensure that domain names don't get stolen.

Client transfer prohibited is an extra precaution on top of all of this. When it is set, your current registrar doesn't have to respond requests from other registrars to transfer the domain name; even when there is a valid authorization code. Your current registrar won't send you email about transferring your domain that contain links that you might click accidentally. The setting protects against some forms of hacking and phishing that have been used to steal domain names.