I really disagree, as someone who has done domain names professionally for almost a decade. How many registrants are going to notice their whois info changed?

I really disagree, as someone who has done domain names professionally for almost a decade. How many registrants are going to notice their whois info changed? Nothing changes with whois info in terms of functionality. 60 days, no big deal. Besides, if I already have your account compromised, I probably have your email, that's how they are linked in the first place. It wouldn't be too hard in most systems to just initiate the transfer and hide that info from the user, or simply lock them out of their email. You think their domain registrar is the first place they will call when their email stops working? HELL NO. They have bigger concerns. They are using a special email address for whois stuff? How often you think they check that? Most people, not all that often. If I didn't subscribe to updates on my whois info from a third party, I wouldn't notice either, and it's my damn job. We can't implement mindless policies to 'protect' people from themselves unless there are real tangible benefits to it and it's not simply self-serving. Of the major registrars, GoDaddy is the only one I know of implementing this policy and they've been hijacked numerous times. Their whois privacy even had a hole in it for years that is now fixed. It's not stopping the hijackings. Other registrars without that policy have better track records preventing domain hijackings.