Whatsapp E2EE - Why scanning the QR-code? E2EE can be established in Whatsapp by scanning the QR-code on the other person’s phone.

But I read on the FAQ page that this code / number can also be sent to the other person via SMS, Email, etc.

Isn’t it possible to establish an E2EE without this «increased» effort? Are they trying to make it difficult for the users? Because as far as I know the computers for an internet connection do these sort of things without these weird methods that Whatsapp uses.

Are there any advantages in scanning a QR-code?
Are there any advantages in scanning a QR-code?


Yes.
But to understand why this provides an advantage we first need to introduce the man-in-the-middle attack (MitM attack). In this attack setup, the adversary sits between you and your communication partner and you are doing your cryptographic computations (the key exchange) with the adversary who then initiates a key exchange with your intended partner and then forwards (some) of your messages to make sure you don't notice the attack. It needs to be noted that you indeed are having a session with the attacker and not with your intended recipient in this case which in particular means two things:


You will see the adversary's public key and not your intended target's and
You will share the agreed key with the adversary and not with your intended target.


On the web, i.e. when you browse websites this is mitigated by so-called certificates which effectively state in a trust-worthy manner "this public key belongs to this entity". Then an adversary can't go ahead and send his public key as the entity's key because he can't come up with the statement / certificate.

However in this scenario, i.e. instant messaging you can't have one central source which says "this key belongs to X" if you don't trust the service provider which end-to-end encryption (E2EE) is all about. So we need another way to ensure that we are actually directly communicating with our intended target. This is where the additional QR-code / number come in. They are essentially a processed version of your public key and the other party's public key. Now if you transmit this information to your intended target in an authentic manner and the information matches you know that you are using their public key and thus that there is no active attack going on.