1. I wouldn't recommend buying used devices, you don't know what has been done with the device, what's running there, even if you reflash it from scratch. Try to buy somehow (anonymously) device in still original and sealed packaging.
2. One would need to first install modified AOSP/CyanogenMod with patched core libraries/apps/services to return fake/random values for device serial number, WiFi and Bluetooth MAC addresses. Otherwise some of the apps might leak this information over the air, even in clear text form.
3. You need to remove or somehow power off the GSM baseband, otherwise you can still be tracked.
I'm not an expert in this area, so there might be a lot other missing weak spots in this guide.
Weak spots:
1. I wouldn't recommend buying used devices, you don't know what has been done with the device, what's running there, even if you reflash it from scratch. Try to buy somehow (anonymously) device in still original and sealed packaging.
2. One would need to first install modified AOSP/CyanogenMod with patched core libraries/apps/services to return fake/random values for device serial number, WiFi and Bluetooth MAC addresses. Otherwise some of the apps might leak this information over the air, even in clear text form.
3. You need to remove or somehow power off the GSM baseband, otherwise you can still be tracked.
I'm not an expert in this area, so there might be a lot other missing weak spots in this guide.