It asks you to choose 4 (four!) "secret questions" as a "security" measure. I decided that keeping your domains with an organization that insists on idiotic practices that are firmly forbidden by every sensible security practices guide (OWASP, NIST 800-63, anything, really) since like 2015 is not a very wise choice.

Tell that to the banks, alarm companies, etc that do the same thing :-/

I just always use a plausible but false and unique answer, which I just keep track of in my password manager.

mother's maiden name: 14t&7--ghv&32@/apER;Aa0)/90sIs

> mother's maiden name: 14t&7--ghv&32@/apER;Aa0)/90sIs

This isn't a good idea....

If using random text, there are many examples of, when asked to answer a secret question, telling the call centre droid "I just hit a few random keys for that one" and this being accepted.

You would do well to assume each call centre droid is a board kid more interested in his co-workers tits than your clever answers to security questions.

Good luck reading that out loud over the phone to technical support if you get locked out of your account.

Technical support sees the answer to the question in plain text, so after you read first three random characters correctly they will confirm your identity and then patiently wait until you finish reading.

Also my real mother maiden name is almost equally hard to comprehend for english-speaking tech support, so it doesn't make much of a difference.

If my mother's real maiden name is Johnson, I write in random false name like Smithers-James.

It's plausible, hard to guess, and harder to social enginer than "It's a bunch of random letters and numbers."

- I don’t get locked out of my account.

- Porkbun doesn’t have this bullshit, how do they get by?

You do you, but that is enough of a red flag to actually mention when somebody recommends Dynadot to everyone else without much elaboration.

Also, banks are really different from domain registrars in several important and relevant respects, but, for the record, I don't have to tell it to the banks I use, and if I did, I'd probably be looking for a bank that I don't have to tell it to.

Just since 2015? Also, thanks, now I feel old.

No, they also disabled a domain with 20k user subdomains without notice based on an abuse report that was weeks old and the site long disabled. Wouldn't trust them with a proper abuse process.