I'm a complete noob about security, so please, forgive me if I say something wrong.

I have to develop a social network. The client will be an Android app and (probably) a web page for smartphones that will use a REST API. Because of the characteristics of the social network, if the info of an user is stolen, it's not very important, but, I have to identify every user by username/password login and I have to be sure that every message comes from the legit user.

I don't want to use SSL (TLS) because I don't have many resources, so I don't want to suffer the latency of SSL and I don't want to pay for the certificate. So, it would be a good idea to use OAuth for securying the REST API? Are there any better approaches?

  • You might want to read up on Man In The Middle (MITM) attacks. If you authenticate, but fail to secure the session, the authentication is wasted effort. – Mark C. Wallace Oct 30 '13 at 11:43
  • Ok, MITM is something that worries me. How can I avoid it without using SSL? Is it possible? – Alex Text Oct 30 '13 at 12:49
  • @Alex Text why would anyone try to do this without SSL/TLS? (this is not possible) – rook Nov 2 '13 at 10:21

HTTPS is an absolute requirement for authenticated communication. HTTPS typically increases CPU demands by less than 2%, and other than the initial handshake HTTPS will not increase network letancy. Without HTTPS you are in violation of OWASP - Insufficient Transport Layer Security. Security isn't just HTTPS, if you are "securing a REST API", you have to worry about other vulenrablites and the OWASP top 10 is a good palce to start.

(On a side note, after so many years I'm still surprised that people think HTTPS is optional, and that somehow encryption is this huge burden. I can perform a few million AES operations per second, and most of the time I can't load a web page in under a second. Why do people think encryption is heavy? I would like an explanation.)

  • 1
    it's one of those myths, sadly. The myth that encryption is this devious, crazy, computationally expensive thing (which it can be, by the way), which is not helped by non-technical people writing articles confusing encryption and hashing and saying that it is computationally expensive to "decrypt hashes", for instance. All of it is hearsay :-( HTTPS requires one more hop, a couple extra if you're verifying the full CA chain, but very few agents should ever do this. – Sébastien Renauld Nov 1 '13 at 21:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.