2

I'm a complete noob about security, so please, forgive me if I say something wrong.

I have to develop a social network. The client will be an Android app and (probably) a web page for smartphones that will use a REST API. Because of the characteristics of the social network, if the info of an user is stolen, it's not very important, but, I have to identify every user by username/password login and I have to be sure that every message comes from the legit user.

I don't want to use SSL (TLS) because I don't have many resources, so I don't want to suffer the latency of SSL and I don't want to pay for the certificate. So, it would be a good idea to use OAuth for securying the REST API? Are there any better approaches?

3
  • You might want to read up on Man In The Middle (MITM) attacks. If you authenticate, but fail to secure the session, the authentication is wasted effort.
    – MCW
    Commented Oct 30, 2013 at 11:43
  • Ok, MITM is something that worries me. How can I avoid it without using SSL? Is it possible?
    – Alex Text
    Commented Oct 30, 2013 at 12:49
  • @Alex Text why would anyone try to do this without SSL/TLS? (this is not possible)
    – rook
    Commented Nov 2, 2013 at 10:21

1 Answer 1

1

HTTPS is an absolute requirement for authenticated communication. HTTPS typically increases CPU demands by less than 2%, and other than the initial handshake HTTPS will not increase network letancy. Without HTTPS you are in violation of OWASP - Insufficient Transport Layer Security. Security isn't just HTTPS, if you are "securing a REST API", you have to worry about other vulenrablites and the OWASP top 10 is a good palce to start.

(On a side note, after so many years I'm still surprised that people think HTTPS is optional, and that somehow encryption is this huge burden. I can perform a few million AES operations per second, and most of the time I can't load a web page in under a second. Why do people think encryption is heavy? I would like an explanation.)

1
  • 1
    it's one of those myths, sadly. The myth that encryption is this devious, crazy, computationally expensive thing (which it can be, by the way), which is not helped by non-technical people writing articles confusing encryption and hashing and saying that it is computationally expensive to "decrypt hashes", for instance. All of it is hearsay :-( HTTPS requires one more hop, a couple extra if you're verifying the full CA chain, but very few agents should ever do this. Commented Nov 1, 2013 at 21:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .