I am starting with bitcoin and even though I understand pretty well how the blockchain works, the seed words used by some wallets (MultiBit and Electrum) give me creeps and doubts. The main question is: Why they are safe? The base for the question: Humans are not good source from random data so we use seed words from a random-pc-time-based source. This seed words are a representation of a binary number and the phrase with 12 words makes a 128bit hash. Those words are drawn from a 4096 words dictionary. The dictionary from Electrum is saved in a python script, for example. So, we can say we know those 4096 words. I have a seed phrase (12 words) from my wallet. What protects all the network of someone who changes the last word of his own phrase 4096 times, to open 4096 bitcoin wallets? I know with Electrum, again for example, that 128 of those 4096 generate valid addresses. What protect the network then of someone opening the bitcoin wallets of 128 mates and stealing all the money? The last part is more simple, the validation is made online, how an wallet check of the words open the private key if they can work offline?
For the vast majority of possible 12-word combinations, the corresponding wallets were empty and never generated. The total number of the combinations is pretty huge so trying to brute-force them will not work out. In fact, words are just another (mnemonic) way to encode the entropy contained in the private key.
It is secure in the same way that private keys themselves are secure; the search space is just so massive that the probability of someone generating a private key or seed which someone else is using is extremely small so as to be basically impossible.
Nothing protects someone from generating hundreds of thousands of keys and hundreds of thousands of seed phrases and seeing if any of them have Bitcoin associated with them. But since the search space is so massive, that person would have an almost 0 probability of finding a key that someone has used. Even if they generated a million keys per second (either randomly or through seed phrases), that person would have a basically 0 probability of finding someone else's private key even if they searched until the heat death of the universe.
The last part is more simple, the validation is made online, how an wallet check of the words open the private key if they can work offline?
That's not how Bitcoin works. There isn't any validation of any sort with private keys. There is no need to "validate" private keys or register them anywhere or the like.
Please note that the order of these words must also be right so this 35 decimal digits of possibilities will increase to 44 decimal digits. Even if you could check 1000.000.000 possibilities per second the time of the universe will not be enough.