EDIT: It looks like hexafraction types faster than I do. I'll go ahead and post my response anyhow since I took so much time to write it, but if you've already read hexafraction's response then there isn't much need to read mine as well.
Hi, I have some questions about bitcoin wallets and how they function. I'm not a developer but I would still like a somewhat technical response so as to better understand what it is that wallet services are actually doing. Sorry if this is not the place to post this stuff please direct me to the right place if it isn't here. As for the questions: Where are private keys stored in services like blockchain.info? Since they say that they do not keep them, how secure is this really, for example if we compare it to a service like bitgo o copay?
Blockchain.info does store your private keys, but they store them in an encrypted format. When you access your wallet, you supply the decryption password to the wallet software (or if you are using a mobile wallet, then the password might be stored in the software no your phone). The wallet software running in your browser (or on your phone) then requests the encrypted keys from the blockchain.info servers. The keys are decrypted in the local software and used for creating transactions.
Since the private keys are all encrypted with your password in your browser (or on your phone) before they are stored on blockchain.info's servers, anyone (employee or hacker) would have to crack your password before they could access your bitcoins. This is why it is very important to choose a strong password if you are going to use a hybrid web wallet like blockchain.info.
Note, that if the blockchain.info service (or some hacker) can trick you into running software that provides them with your password, then they can retrieve your encrypted private keys from the blockchain.info servers, decrypt them with the password you've provided, and steal your bitcoins.
Another question I have is related to 'lightweight' wallet clients vs 'heavy' ones, does this mean that the user simply downloads a software plus the blockchain (full node)
A "full node" is software that doesn't trust any of the data that it receives from any peers at all. It connects to peers on the network and starts with the genesis block hard coded into the software. Then validates EVERY transaction and EVERY block that it receives from peers. Since every transaction requires valid inputs from the outputs of a previous transaction all the way back to the block rewards, the full node must download and process the entire blockchain.
There are a few different types of "lightweight" wallets. The two main ones are client/server and SPV.
In a client/server wallet, the client software that you run stores your private keys and builds transactions, but it trusts a server that supplies it with information about what transaction outputs are available to it. The server would be a full node that communicates with other peer full nodes on the bitcoin network to keep up to date with all the transactions and blocks. A single full node server could then support many connected clients.
In a SPV wallet, the software connects to full node peers and looks at recent blocks. The SPV wallet assumes that if a transaction is deep enough in the blockchain, and that multiple full node peers are all stating the same thing about the transaction, then it is accurate enough to be trusted. As such, the SPV wallet trusts the peers that it is connected to to provide accurate information about the current blocks.
and then does not depend on the developer in order to use his wallet, whilst a 'light' client means that the user is dependant on communications with the wallet provider since they are the ones ultimately running the node and thus can actually perform the transaction?
As long as the software is open source and well reviewed, you shouldn't need to just trust the developer. If you have the ability, you can review the code yourself and make sure that the software doesn't do anything malicious. If you trust someone that can review the code for you, then you can ask them to do so, or you can trust that someone in the community would point any issues in the code.
