Basically, with ring signatures a transaction output is signed by you and by a group of random signatories (garnered from the utxoset, and the number of signatures is specified by you). Only one of these signatures is "true" (and that can be determined by the recipient), but to an outside observer they cannot determine which of the N signatures on an output is true, as they all appear to be valid.
Firstly, thanks for the comprehensive explanation. You said in the quoted paragraph "the number of signatures is specified by you". Of course, the bigger, the harder to find the sender, right? Is there any bound for it? And, where can I set that?
Well, remember that you first need to crack either end of a transaction before you even get to the ring signature stage. Pragmatically, then: let's say you've purchased "ileegil drukz" from Walter, a manufacturer. He gets busted by the DEA who beat him with a pipe wrench until he reveals his wallet password. Now they can see all of the incoming transfers. They pick one of them that has, say, a mixin of 5. They now have 5 seemingly valid signatures on each of the transaction outputs (but no direct way of knowing who those 5 signatories are, short of knowing the identity of every single wallet holder on the network). Quite literally the only way for them to prove a transaction happened is to have access to both the sender and the recipient's private keys.
There is no upper bound on mixin, but each signature increases the size of the transaction, so when we move to per-kb fees a higher mixin will cost more. Right now you're only bound by physical transaction size limits. Just to confirm that very high mixins work, I created
a 1 XMR example transaction with a mixin of 100 no problem, and it was mined and confirmed with a minute.