Read phone state and identity I've looked at many (not all) of the dozens of links here. 

Is there a list that explains the risks involved with each granted application permission type?

Most of these are not worth the time to read and just regurgitate using the same vague, indeterminate descriptions already used by the phone.

I've googled for specifics, but can find no detailed information on this privacy warning.

Please don't reply with generic blog articles and endless lists of links.

I'm looking for one hard core detailed reference on this warning:

Read phone state and identity

Here's what mine says:


Allows the application to access the phone features of the device...  

What specifically is a "phone feature" and what is not? Is wifi a phone feature, text message stack, etc
An application with this permission can determine the phone number and serial number of this phone...

Right. This is clear.
Whether a call is active...

Understood.
The number that the call is connected to...

Is this giving the company permission to spy on my friends?
and the like...

Yep, it really says this. Please define "the like".


Obviously #1, #4 and #5 are the things that concern me - the language of this warning says that the game developer gets access to all the identity information of anyone who calls you...  And the like.  

Therefore, to me, it clearly says you are exposing yourself and your contacts to spammers and worse. And it looks like the app can scoop up your contacts whether you are playing the game or not.

In other words, unless you are willing to give the developer the identities/contact info of anyone who calls you (or you call), subjecting them to spam or worse, you should not d/l the app.

Correct?
With this permission an app can...


read your IMEI/IMSI (to identify your device/SIM), #2 in your list
read your phone number (from the SIM)
which provider is used (again, the SIM)
see whether a call is active (#3) and if so, phone number of the remote party (#4)


Your #1 is simply an introductionary phrasing. With Android 1.6 and before, this permission was required to detect whether there was a call being processed (so a game or media player could pause). This is no longr the case since 2.0 (basically even not with 1.6, but due to a bug this permission was still automatically "injected" by the SDK).

In newer versions, it is mostly used to...


identify your device for target-ads (so the ad provider could tell whether a certain ad was already shown to you)
rightfully by call-blockers and similar apps which need to determine the remote phone number
for several statistics and other technical apps (again, rightfully)


And well, in a way it gives someone the possibility to spy. Some malware uses it (in connection with other permissions) to create a profile of you.

I'd say in most cases the dev is not interested in this, but it's rather the ad module requiring this permission. Concerning this, please also see: What information does stock Android send to Google by default, and how do I opt-out? -- which also covers the ad-modules stuff.