[Galaxy Note II Original Android Development] pulser_g2:
Not really that OT tbh - ensuring user privacy is important to me. That's why there are no gapps listed in the OP, and no links to gapps in any of my posts... I don't post spyware, thus I don't post gapps... ;) (it is a real eye opener to look at what some of the gapps do!)

Indeed, there is a project by the EFF that will attempt to work out the entropy of your unique browser footprint per its useragent, fonts, etc as you said. The fonts one is quite handy - that offers a fair bit of entropy.

In terms of user privacy, consider your privacy "compromised" (ie. you can be identified between 2 separate clean flashes of the ROM) if any app can get any kind of "unique" identifier of your device. This includes, for example, IMEI, IMSI, phone number (though I have wiped out the phone number on my SIM card, so even my phone doesn't know its own number!), CPU serial number, device serial number etc...

If any app can obtain any one of these, your privacy is gone.

For anyone interested, here is a little experiment to show you JUST how vulnerable Android is, out of the box...

Install the app Droid Examiner (it is open source, no need to worry, you can look at the code) - you can get it from Play at https://play.google.com/store/apps/details?id=jackpal.droidexaminer&hl=en, or from F-Droid (https://f-droid.org/repository/browse/?fdfilter=droid%20examiner&fdid=jackpal.droidexaminer)

Or if you just want the APK, https://f-droid.org/repo/jackpal.droidexaminer_1.apk

Either way, pay REAL close attention when you install it. Notice how it does not request a single permission. Also notice it does NOT use root access. Let's have a delve... Start with "build".

We have the board name (smdk4x12) - that narrows the device down to a Galaxy S3 or Note 2 (or similar). We have the bootloader version (perfect for rogue software wanting to exploit the bootloader). We have the brand (Samsung). We know the device is ARMv7, and we are told it is the t03g (Note 2, International).

We also see that this ROM is a userdebug CM build, and that it is of type, "eng.pulser.20130802.172046 test-keys", telling you PRECISELY which version of the ROM is being used, down to the time of the build. It also tells you the build fingerprint (which is a copy of the official Samsung one). But down at the bottom is more interesting... See that line, "serial"?

Yes, that's right! Your device Serial number is visible to ANY app, WITHOUT asking your consent. Without notifying you. This is unique to your handset. That's the purpose of a Samsung serial number :)

Battery isn't hugely interesting, it tells you the level of the battery and voltage/temperature. Cameras likewise tells you there's 2 cameras on the device... Let's skip the next few, they're rather boring.

CPU Info... Ooh look, down at the bottom, there's "Serial" - this is your CPU serial number, which is usually lasered onto the chip at time of manufacture. And that's available to ANY app, without asking.

So yup... There's 2 totally unique identifiers for your device, accessible to any app, without your knowledge. Android is a failure in terms of protecting user privacy.

Fortunately... There is a solution! All this information was available from /proc on the filesystem. If you use XPrivacy (requires Xposed Framework) from http://xdaforums.com/showthread.php?t=2320783, you can protect your personal information. It can block access to /proc, preventing apps from sniffing your serial numbers etc.

Anyway, long story short, app developers don't even need to fingerprint your device - it leaks out 2 TOTALLY unique identifiers by default. CPU serial number, and device serial number... When I use my phone, I expect it to be as unidentifiable as any other device out there - I don't WANT it to have any unique identifier available to applications. I don't WANT an app to be able to recognise me next time I use it. I don't WANT to log in, I don't WANT to give you my serial numbers.

Anyway, the solution for now is XPrivacy, the only tool I'm aware of which can protect the /proc filesystem from nasty apps. Once again, that app required not a single permission, and it could get all that information about our device. Has Google done anything about that? Has CM done anything about that? Nope... Will I do something about it? Hell yes...