Are there any advantages in scanning a QR-code?
But to understand why this provides an advantage we first need to introduce the man-in-the-middle attack (MitM attack). In this attack setup, the adversary sits between you and your communication partner and you are doing your cryptographic computations (the key exchange) with the adversary who then initiates a key exchange with your intended partner and then forwards (some) of your messages to make sure you don't notice the attack. It needs to be noted that you indeed are having a session with the attacker and not with your intended recipient in this case which in particular means two things:
- You will see the adversary's public key and not your intended target's and
- You will share the agreed key with the adversary and not with your intended target.
On the web, i.e. when you browse websites this is mitigated by so-called certificates which effectively state in a trust-worthy manner "this public key belongs to this entity". Then an adversary can't go ahead and send his public key as the entity's key because he can't come up with the statement / certificate.
However in this scenario, i.e. instant messaging you can't have one central source which says "this key belongs to X" if you don't trust the service provider which end-to-end encryption (E2EE) is all about. So we need another way to ensure that we are actually directly communicating with our intended target. This is where the additional QR-code / number come in. They are essentially a processed version of your public key and the other party's public key. Now if you transmit this information to your intended target in an authentic manner and the information matches you know that you are using their public key and thus that there is no active attack going on.