Thank you for the replies guys, really appreciate it! The thing is that my friend thinks I'm an idiot who doesn't know what he's talking about so we reached to community to see what they think. I've told basically the same things to him that you did. Only thing as I don't understand where seed phrase is stored though. I mean, how wallet knows what file to download when I enter my seed pharese. That should be it. Thanks a lot!
They do not download any because the "wallet" isn't stored anywhere. The seed is the wallet (in easy words). The software (Electrum) derivates the private-keys from the seed and this process is totally decentralized, offline and trustless.
I agree with TryNinja, but think his answer might be a little bit to technical and probably a bit to short. Since you're asking these questions and have these doubts, i can assume you're pretty new to the cryptocurrency ecosystem and have little or no knowledge about the techical details, am i right? There's no shame in this, we all had to learn at some point...
In this case, i'll try to simplify things so you'll have a very basic understanding of what is happening.
I'm simplifying here, this isn't the complete technical explanation!!!!Bitcoins aren't a physical thing, they aren't stored on your hard disk. The bitcoin network is basically a ledger (think of it as a big excel sheet). This ledger contains records (lines in the sheet) that indicate which address is funded with how much unspent outputs (and the value of these unspent outputs).
Since this ledger is decentralised, it's stored on thousands of nodes, so everybody knows what the balance of each address is at any point in time. In order to spend the unspent outputs, you have to generate a signature. This signature is created by a PRIVATE KEY. ONLY the owner of the address is supposed to have this private key (that's why they call it private).
The address is the hash of the public key that belongs to this private key. So if you decide to spend an unspent output funding your address, everybody in the world will be able to verify if the signature you provided is valid, since they have your public key, but nobody will be able to recreate this signature since they do not have your private key.
What electrum does is: it gives you a seed phrase.
This seed phrase is converted into a master private key
Individual private keys are derived from the master private key
The public key is derived from each private key
The public key is then hashed to generate the address
Electrum now queries the electrum nodes with the ADDRESS... The nodes reply which unspent outputs are funding this address... Electrum does NOT send the private key, the master private key or the seed phrase to the electrum node. When you create a transaction, the PUBLIC KEY will be included aswell and the transaction will be broadcasted to a node.... An electrum node will only receive an address, and it'll send information that's publicly known back to the individual's wallet.
The wallet uses the information it receives from the node in order to build and sign a transaction. The transaction will use the unspent outputs funding addresses controlled by him as inputs to create a new transaction, the derived private key(s) will be used to sign the transaction ON THE INDIVIDUAL's PC. The private key(s) will never leave your pc (unless you downloaded a malicious client, or are infected, or are running a very old electrum version). Once a transaction is signed, it'll be broadcasted trough the nodes, but a signed transaction does NOT contain any private key or seed. It contains a list of unspent outputs that'll be used as input, a list of PUBLIC keys, a list of new unspent outputs that'll be created and signatures... No information that's harmfull to you is included in a transaction, so a node will not be able to rob you.
SOOOO... long story short. In order to rob you, a node would need the seed phrase, the master private key or the derived private key key. The node NEVER receives this data from an electrum wallet. You can verify this if you read electrum's sourcecode. Many developers have already verified the sourcecode and confirmed no seed phrase, master private key or derived private key are being sent to the node. The code just isn't there to do this.
