Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm a complete noob about security, so please, forgive me if I say something wrong.

I have to develop a social network. The client will be an Android app and (probably) a web page for smartphones that will use a REST API. Because of the characteristics of the social network, if the info of an user is stolen, it's not very important, but, I have to identify every user by username/password login and I have to be sure that every message comes from the legit user.

I don't want to use SSL (TLS) because I don't have many resources, so I don't want to suffer the latency of SSL and I don't want to pay for the certificate. So, it would be a good idea to use OAuth for securying the REST API? Are there any better approaches?

share|improve this question
You might want to read up on Man In The Middle (MITM) attacks. If you authenticate, but fail to secure the session, the authentication is wasted effort. – Mark C. Wallace Oct 30 '13 at 11:43
Ok, MITM is something that worries me. How can I avoid it without using SSL? Is it possible? – Alex Text Oct 30 '13 at 12:49
@Alex Text why would anyone try to do this without SSL/TLS? (this is not possible) – rook Nov 2 '13 at 10:21

HTTPS is an absolute requirement for authenticated communication. HTTPS typically increases CPU demands by less than 2%, and other than the initial handshake HTTPS will not increase network letancy. Without HTTPS you are in violation of OWASP - Insufficient Transport Layer Security. Security isn't just HTTPS, if you are "securing a REST API", you have to worry about other vulenrablites and the OWASP top 10 is a good palce to start.

(On a side note, after so many years I'm still surprised that people think HTTPS is optional, and that somehow encryption is this huge burden. I can perform a few million AES operations per second, and most of the time I can't load a web page in under a second. Why do people think encryption is heavy? I would like an explanation.)

share|improve this answer
it's one of those myths, sadly. The myth that encryption is this devious, crazy, computationally expensive thing (which it can be, by the way), which is not helped by non-technical people writing articles confusing encryption and hashing and saying that it is computationally expensive to "decrypt hashes", for instance. All of it is hearsay :-( HTTPS requires one more hop, a couple extra if you're verifying the full CA chain, but very few agents should ever do this. – Sébastien Renauld Nov 1 '13 at 21:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.