I'm a complete noob about security, so please, forgive me if I say something wrong.
I have to develop a social network. The client will be an Android app and (probably) a web page for smartphones that will use a REST API. Because of the characteristics of the social network, if the info of an user is stolen, it's not very important, but, I have to identify every user by username/password login and I have to be sure that every message comes from the legit user.
I don't want to use SSL (TLS) because I don't have many resources, so I don't want to suffer the latency of SSL and I don't want to pay for the certificate. So, it would be a good idea to use OAuth for securying the REST API? Are there any better approaches?