Skip to content

DEF CON 34 talks are here: 354 talks, summarized and searchable.

Browse DEF CON 34

InQuorigible - Quora in Missing Persons OSINT

Miranda Tedholm

Where

Recon Village
DEF CON 34

Duration

36 min

Shows how Quora keeps deleted questions, activity logs and banned-user traces visible to anyone who knows a username, useful for OSINT investigators.

Summary

The speaker, who volunteered on a missing persons investigation, looks at Quora as an OSINT source. The site runs on natural-language questions that draw in a young, less tech-savvy audience. Moderation is mostly automated, user-owned spaces are not bound by the same disclosure rules as main-site answers, and accounts are easy to register, flip or replace. The talk argues that this combination shapes who uses the site and how they can be found.

The central section covers what stays visible after a user removes content. Deleting a question or limiting a post often leaves the title, slug and author reachable through the public log, activity tab and page source. Follower and following lists, edit history and comment types can help rebuild the shape of an interaction even when the words are gone. Banned accounts keep much of this data visible too. The speaker maps these patterns to OWASP API3 and CWE categories, arguing that exposure of deleted personal content fits CWE-359 better than the broader CWE-200.

The closing part asks the OSINT community to treat Quora as a target in its own right, to report such exposures to the platform and to child-safety reporting channels, and to build better tooling. The speaker shares a bibliography on GitHub and a small username-check tool, and invites collaboration on deeper analysis of the site's JSON responses.

Materials

Related talks