shareviahttp VS protocol

I use https://github.com/marcosdiez/shareviahttp all the time, to share with other phones or with my ereader or PC.

>https://github.com/marcosdiez/shareviahttp

adds a share option (Android) that bundles everything into a zip, starts an http server, and creates a QR code (to http://my-ip-address/).

Not out of the box, and susceptible to wifi blocking p2p, but otherwise very usable.

And where you have python installed you can do

Not the fort-knox implementation it claims on the tin.

'LocalSend uses a secure communication protocol that allows devices to communicate with each other using a REST API. All data is sent securely over HTTPS, and the TLS/SSL certificate is generated on the fly on each device, ensuring maximum security.'

How do they achieve maximum security while generating X.509 certs on device?

Let's look; 'https://github.com/localsend/protocol#2-fingerprint'

'When encryption is on (HTTPS), then the fingerprint is the SHA-256 hash of the certificate'

Confusingly there is a HTTP non encrypted mode, and the docs claim the fingerprint only used to avoid discovery collisions.

Out-of-band [visual comparison / QR code scanning step] sharing of fingerprints COULD be acceptable to prevent 'man in the middle' attacks, however the documentation doesn't seem to indicate that this detail is surfaced or shared with the user.