InQuorigible - Quora in Missing Persons OSINT
Where
Recon Village
DEF CON 34
Duration
36 min
Shows how Quora keeps deleted questions, activity logs and banned-user traces visible to anyone who knows a username, useful for OSINT investigators.
Summary
The speaker, who volunteered on a missing persons investigation, looks at Quora as an OSINT source. The site runs on natural-language questions that draw in a young, less tech-savvy audience. Moderation is mostly automated, user-owned spaces are not bound by the same disclosure rules as main-site answers, and accounts are easy to register, flip or replace. The talk argues that this combination shapes who uses the site and how they can be found.
The central section covers what stays visible after a user removes content. Deleting a question or limiting a post often leaves the title, slug and author reachable through the public log, activity tab and page source. Follower and following lists, edit history and comment types can help rebuild the shape of an interaction even when the words are gone. Banned accounts keep much of this data visible too. The speaker maps these patterns to OWASP API3 and CWE categories, arguing that exposure of deleted personal content fits CWE-359 better than the broader CWE-200.
The closing part asks the OSINT community to treat Quora as a target in its own right, to report such exposures to the platform and to child-safety reporting channels, and to build better tooling. The speaker shares a bibliography on GitHub and a small username-check tool, and invites collaboration on deeper analysis of the site's JSON responses.
Materials
Related talks
Recon Village·25 min
Michael Reimsbach · Rishi C
Shows how to spot fake job candidates with OSINT, from reverse image searches and public records to document checks and personal privacy hygiene.
HackersTown·26 min
LambdaCalculus
Surveys how the web became dominated by big-tech platforms and offers self-hosting and decentralized alternatives for reclaiming online services.
Main Stage·47 min
Vitaly Simonovich
Shows how LLM-assisted research turned five open-source C2 frameworks into a source of flaws that defenders can use against attacker infrastructure.


