How much information can websites get about your browser/PC?

There is more: the Electronic Frontier Foundation (EFF) brought out a tool called Panopticlick which shows mostly the same information but additionally scans your installed fonts.

Installed fonts are probably the most identifying piece of information as soon as you start adding one or two. Just because of the amount of fonts out there, it is unlikely to have the same set of fonts on two different computers. (As long as they are used by different persons)

Edit (from comments): A countermeasure to this is either disabling JavaScript (through an addon like NoScript for example) or to disable both Java and Flash plugins in the browser, as at least one of them is needed to extract the information.

How do they get it?

Passive identifiable information is mostly collected from headers of the communication packets.

When a browser requests a URL, this requests undergoes through several layers of OSI model and several network protocols. The upper level protocols such as HTTP and TCP/IP probably provide most of the information displayed on that web site. This information is usually stored in a packet header and was originally embedded there to help servers understand: what is the best representation of the information for your environment.

A user-friendly list of current HTTP headers is available from Wikipedia. A more technical reference is RFC 2616 Header Field Definitions or RFC 2616 itself, see section 14.

How to protect your privacy?

Another very popular technique to track a user is via specific cookie - this is how ad providers know which ad to show you (which makes me very wary). See answers for my question: How to remove tracking cookies. Answers actually cover a lot more possible defences against other tracking techniques.

Perhaps a more secure way to stay anonymous online is to use some dedicated security projects, one of which is TOR.

In terms of information you can obtain passively without using Java/Flash - that's pretty exhaustive.

You could perhaps do things like estimate PC performance using a JavaScript benchmark, but you're really pushing at that point.