Develop Bugs

Everything KNOX...

FYI: Please don't get offended by me posting this thread. I searched and couldn't find anything dedicated to KNOX and discussions about it. So I created a thread where we can hammer out our ideas, and logic.
Firstly, here is a little video explaining what Samsung KNOX is:
My "cliff note" explanation of what KNOX is:
A virtual environment, on your phone, where running "un-approved" applications, will not affect the KNOX environment. In other words, it's like running a program like Virtual Box for your Note 3, and only pre-approved "limited" apps can run in this environment. In the video, it says how taking a picture, can be emailed and shared, yet outside of KNOX, you can't access this picture.
https://www.samsungknox.com/
KNOX has been in development for quite some time. What I have found out, it's like Fort Knox (get the pun?). Fort Knox is known to be impenetrable (http://ainulfarina.blogspot.com/2013/01/fort-knox-most-secure-vault-in-world.html). Samsung has partnered with various software and hardware companies to develop a platform for the infrastructure of business, with security in mind. We're talking about security on the hardware level. To market this, to tap into the business/enterprise world, using the Note 3 as the preferred paperless, go to device. To achieve this, they need sell the idea that security is king. However, they don't want to exclude the rest of the market of the common everyday individual. That's why Samsung tag line is "Work and play on one device".
This KNOX environment needs to be installed and set up. The desired list of apps would need to be pre-approved for your devise as part of the set-up process. I'm sure this is on an organizational level.

I have a couple of questions on KNOX which I hope the answer is Yes to both:
Will it work if the phone is un-rooted, but had been previously rooted?
Will it prevent MDM applications from reading personal stuff like installed text messages and other stuff outside of KNOX on the phone?
There are a few things that I'd like to do which requires root to do. A couple of examples, among many, are removing bloatware that can't be disabled and BT pairing a PS3 controller.
My employer has selected MobileIron for their MDM due to the head of Security having some relative there (nepotism) when there were plans to use and sell as a SaaS solution the less intrusive AirWatch. Interest in MobileIron by our customers is much lower than AirWatch since it doesn't fit into the SaaS model like our other services.
The big problem with MobileIron from an end user perspective is how intrusive it is. It logs everything and sends that info to the management server; this includes text messages. On company issued equipment, no privacy is to be expected however, that privacy is expected on my personal stuff. I'm told MobileIron has the capability to go through the phones storage and download anything.
I'll consider leveraging KNOX if those two questions have "Yes" as an answer. Frankly, my employer is being unreasonable with their mobile requirements (long story) and the head of Security maintains his ass as his hat with more power than he should because of his relationship with a VP or the CEO. I have been using an alternate method to the silliness of walking around with two phones that facilitates their electronic checks; I just don't advocate the solution.

noc007 said:
I have a couple of questions on KNOX which I hope the answer is Yes to both:
Will it work if the phone is un-rooted, but had been previously rooted?
Will it prevent MDM applications from reading personal stuff like installed text messages and other stuff outside of KNOX on the phone?
Click to expand...
Click to collapse
I have many friends who have rooted their phones, but none that I know use the KNOX environment. Even using the Note 2 for a full year, this is the first time i've heard of KNOX when exploring my Note 3.
I also want to know if triggering the KNOX flag, can that environment still be accessed, or even installed?
I can only assume the answer would be "yes" to your second questions, since it's a separate environment altogether. I understand that anything done outside KNOX mode is excluded from effecting it, however wouldn't it be the same from within?
To answer your first question, we would need someone who rooted their phone, and simply select KNOX from the app drawer, go through the install process and find out.

While I haven't chosen to activate or use Knox, I believe you are limited to installing apps from the Knox store. You can see the apps available on the store at the Knox Website.
Not only will Knox basically run all apps in a sandbox, it will only run Knox approved apps, further locking down the possibility of something bad being installed. You can't even take a screen shot in the Knox environment. Think of it as a locked down virtual box on your phone, that separates your work life from your private, and protects the work related data.

selinux

lawalty said:
I also want to know if triggering the KNOX flag, can that environment still be accessed, or even installed?
Click to expand...
Click to collapse
Once the KNOX WARRANTY VOID bootloader flag is set to 0x1, the phone is considered compromised and the KNOX secure container cannot be created. In other words, once you root, the KNOX sandbox will never function again.
The flag is there for exactly this purpose - to disallow compromised devices from accessing secure apps and systems that require sandboxing; the fact Samsung also started using it to deny warranty claims is a side effect caused by their greed.

siraltus said:
Once the KNOX WARRANTY VOID bootloader flag is set to 0x1, the phone is considered compromised and the KNOX secure container cannot be created. In other words, once you root, the KNOX sandbox will never function again.
The flag is there for exactly this purpose - to disallow compromised devices from accessing secure apps and systems that require sandboxing; the fact Samsung also started using it to deny warranty claims is a side effect caused by their greed.
Click to expand...
Click to collapse
I really think Samsung should of had a business line of Note 3 devices, as compared to every phone having the Knox "container", I think it's a contributing Factor to the bootloop issues that are widespread and creating more headaches than it's worth.
There's going to be a very small population of users that will actually consider even using Knox, yet as stated, is creating major issues in the Note 3 community.
Sent from my SM-N900T using XDA Premium 4 mobile app

What was Samsung thinking of putting KNOX on the Note 3s with unlocked bootloaders? If simply rooting the phone triggers the KNOX flag, permanently flagging the phone for any future dealings with this secure mode for businesses, wouldn't it be simpler to only have the flag if rooted?
So if your phone is not rooted, then you can install KNOX. If you phone currently is rooted, then no KNOX.
My fear is that other companies, that don't like people rooting the phones where their apps are installed on, might hop on this, and consider this as a solution.
Sent from my SM-N900T using XDA Premium 4 mobile app

knox flag is the same thing as the note ii warranty flag. wtf do they call it knox
anyway its bs i cant use knox if im rooted

siraltus said:
Once the KNOX WARRANTY VOID bootloader flag is set to 0x1, the phone is considered compromised and the KNOX secure container cannot be create.... the fact Samsung also started using it to deny warranty claims is a side effect caused by their greed.
Click to expand...
Click to collapse
Just open the phone, use some fine wires to pump enough voltage and current into it to fry some stuff. Make it look like a charger or battery issue. Warranty still "valid". They want to screw us, we can screw back.

muqali said:
Just open the phone, use some fine wires to pump enough voltage and current into it to fry some stuff. Make it look like a charger or battery issue. Warranty still "valid". They want to screw us, we can screw back.
Click to expand...
Click to collapse
So I wasn't the only one. Did this once back in the Nokia 2110 days. They got smart and put tamper proof stickers on them these days. Some I heard even hide them.
Sent from my SM-N900T using Tapatalk 4

You can root, install ROMs, trigger all the trip wires they have, and if something does go wrong, or there is a real issue that has nothing to do with rooting like dust under the screen, but now Samsung refuses to honor the warranty because the Knox is void, try to install a ROM that is not for the phone and hard brick it. 100% no chance of it ever booting again. No tamper evidence of opening the phone. "Gee Samsung I don't know what happened. I went to turn it on, and nothing happens. I'm under warranty, so I'll send it in for repair." "Hello customer, We confirm the phone will not turn on. We are replacing it for you under warranty. Here is your new phone." Hmm.. I can see people doing this because Samsung is trying to avoid warranty claims for legit issues.

bobbyphoenix said:
You can root, install ROMs, trigger all the trip wires they have, and if something does go wrong, or there is a real issue that has nothing to do with rooting like dust under the screen, but now Samsung refuses to honor the warranty because the Knox is void, try to install a ROM that is not for the phone and hard brick it. 100% no chance of it ever booting again. No tamper evidence of opening the phone. "Gee Samsung I don't know what happened. I went to turn it on, and nothing happens. I'm under warranty, so I'll send it in for repair." "Hello customer, We confirm the phone will not turn on. We are replacing it for you under warranty. Here is your new phone." Hmm.. I can see people doing this because Samsung is trying to avoid warranty claims for legit issues.
Click to expand...
Click to collapse
Actually, Samsung will still fix a KNOX-tripped device, as long as it's under 12-months old, just not for FREE. You pay shipping + materials + labor, which is still way better than having to a re-buy a new $700 device. We can argue all day that Samsung shouldn't be "lame" in refusing to fix certain hardware problems that could not possibly be blamed on rooting & ROMming, but that's their right.
(Read Samsung's warranty fine-print yourself if you'd like)

zmore said:
Actually, Samsung will still fix a KNOX-tripped device, as long as it's under 12-months old, just not for FREE. You pay shipping + materials + labor, which is still way better than having to a re-buy a new $700 device. We can argue all day that Samsung shouldn't be "lame" in refusing to fix certain hardware problems that could not possibly be blamed on rooting & ROMming, but that's their right.
(Read Samsung's warranty fine-print yourself if you'd like)
Click to expand...
Click to collapse
That's like saying buying a laptop that comes with Windows and then installing Linux on it voids the warranty. They are getting absurd amounts of money from us, it's just pure greed on their part.

01010001 said:
That's like saying buying a laptop that comes with Windows and then installing Linux on it voids the warranty. They are getting absurd amounts of money from us, it's just pure greed on their part.
Click to expand...
Click to collapse
PC makers would do the same if they could. They started down that road with Trusted Computing and secureboot, but PCs have historically been more open.

Steve Lazarus said:
I really think Samsung should of had a business line of Note 3 devices, as compared to every phone having the Knox "container".
Click to expand...
Click to collapse
I TOTALLY agree! Again, why would the brain-heads over at Sammys have this KNOX crap on all their flag ship phones, with unlocked bootloaders? Wouldn't it make more sense to sell a business/enterprise Note 3 directly to businesses with this KNOX crap pre-installed with locked bootloaders, and leave us flag ship unlocked bootloaders alone.
GEEZUS! [face-palm] It just doesn't make sense.
Sent from my SM-N900T using XDA Premium 4 mobile app

I'm telling you all. If this doesn't get bypassed somehow, and it remains completely permanent, other companies will eventually get on board with this nonsense. Especially DRM with music and video. This KNOX flag just might stand the test, and remain.
Sent from my SM-N900T using XDA Premium 4 mobile app

Knox seems to me, to be a bit of a redundant idea.
If you cannot protect your own device, because let's be serious security starts at the USER not some software you have installed, then watch the websites you visit and the apps you load from third parties.
Knox is a false sense of security if you ask me. It makes the inexperienced user feel like their device is impenetrable, which it isn't.
Its like a desktop, your desktop will only be as secure as you make it, based on how you use it. There will always be security threats, always. You need to learn how to protect YOURSELF rather than depend on some bogus app.

d474corruption said:
Knox seems to me, to be a bit of a redundant idea.
If you cannot protect your own device, because let's be serious security starts at the USER not some software you have installed, then watch the websites you visit and the apps you load from third parties.
Knox is a false sense of security if you ask me. It makes the inexperienced user feel like their device is impenetrable, which it isn't.
Its like a desktop, your desktop will only be as secure as you make it, based on how you use it. There will always be security threats, always. You need to learn how to protect YOURSELF rather than depend on some bogus app.
Click to expand...
Click to collapse
I think you misunderstand the purpose of knox. Knox does not exist to provide security to the end user. Knox is for BYOD business environments. Because the devices are user not employer provided, it would be an administrative nightmare to inspect every device that users want to bring into the corporate environment. By leveraging knox, a company can institute a policy that user provided devices cannot have the knox flag tripped if they want access to the corporate network resources and applications. Trip the flag, no access for you.
Sent from my SM-N900T using XDA Premium 4 mobile app

moto211 said:
I think you misunderstand the purpose of knox. Knox does not exist to provide security to the end user. Knox is for BYOD business environments. Because the devices are user not employer provided, it would be an administrative nightmare to inspect every device that users want to bring into the corporate environment. By leveraging knox, a company can institute a policy that user provided devices cannot have the knox flag tripped if they want access to the corporate network resources and applications. Trip the flag, no access for you.
Sent from my SM-N900T using XDA Premium 4 mobile app
Click to expand...
Click to collapse
I agree, however it should be more a toggle than a permanent switch. Example, if your device is presently rooted with a custom recovery, then no knox. If your device was rooted but not anymore with oem recovery, then yes to knox.
This permanent flag is disheartening.
However, I can envision using this as a good selling point. Taking a pic of your phone's screen for ebay, showing to the world it has NEVER been rooted. I guess you would have proof.
Sent from my SM-N900T using XDA Premium 4 mobile app

[Q] New Note 10.1-14 User of about 2 weeks and extremely happy with it

Coming from an Asus TF201 Transformer Prime, my new Samsung Note 10.1-14 is a miracle. Everything works wonderful, and I can do several things at once!
I'm confused about the purpose of the Knox apps. Is that basically a secure area inside of the normal OS that can be used to isolate certain activities from the rest of the tablet?
I just used it to set up my corporate email Exchange Activesync. This thing has absolutely absurd security requirements, but do those only apply while I'm inside KNOX? For instance, the Activesync is allowed to perform a factory reset on my device. If that happens, will it truly wipe the whole thing or just the Knox app area?
And how do I get more applications within Knox? I've already purchased OfficeSuite Pro 7 previously, but I can't seem to get to it from within Knox.
Any clarification on the purpose of Knox is much appreciated!

Just wanted to let you know im coming from the tf201 too and i completely understand what you mean like day and night.
I don't really have answers for your knox questions though, I thouht Knox is judt a hardware encrypted container for important files. But I'm sure someone will have an answer for you!

I think the Knox apps are available in the Samsung store only so won't necessarily register anything you have bought through the play store.

Enzymaticracer said:
Any clarification on the purpose of Knox is much appreciated!
Click to expand...
Click to collapse
Think of KNOX as a separate and distinct instance of Android running alongside the primary version. Only apps with the KNOX logo (little gold colored key hole in the lower right corner) can be used in KNOX mode. KNOX apps don't show on the personal partition and vice versa. While in KNOX there's a KNOX Apps icon that lists what apps are available for use in the KNOX partition. If they have a price you have to re-buy them even if you're already using them in your personal partition.
I use KNOX but more as a repository for data I wouldn't want multiple clients to accidentally see should they be using my tablet. A lot of people use it for their porn stash, probably not what Samsung created it for.
Here's more detail on KNOX...
https://www.samsungknox.com/en

Thanks! Will be looking through that.
Sent From my Samsung Galaxy Note 10.1 2014 Ed.

Mine arrived today from Singapore and I'm very happy with it. I changed a lot of tablet I had also note 8 or asus tf700 but this is really a beast. It's perfect and I love it
Samsung SM-P605 - Tapatalk

What is Knox an why do I care?

Please forgive the catchy title as well as my ignorance as while I have been around computing stuff for a long time, am kinda new to the Android stuff.
For me, I picked up a Samsung Strat II this summer, an have gotten a bit used to that, so just grabbed a 8.4 for Xmas as I have more uses for that, an would like to get that running as best as possible.
For the Strat II, I did root it with Towelroot an with no noticeable side effects, so understand the hows an why's of this.
But in reading the forums for the 8.4, have been seeing this thing about tripping the Knox from messing with the OS in anyways in regard to rooting.
From the little bit I have read, it seems to be some kind of root tripper, an would assume that voids any warranties too, but was wondering if some could explain it a bit more to me, an perhaps answer the following questions.
1: Does it in fact trip from a root an does this void the warranty?
2: This does not seem to be part of my Strat II OS, so is this something newer?
3: If indeed it is just a warranty thing, do I care once it's out of warranty? Which I think is one year?
4: Is it just a OS recording thing, or does it mess up the tab in anyway, software or hardware wise?
5: From what I have read, once tripped, its permanent an there is no way to reverse that even from a complete system reset, so is that true?
So those are just a few at the moment an again, please forgive my ignorance, but hey, if you don't ask, you don't learn.
Thanks for any help

if you used towelroot then you probably didn't trip knox, knox will trip if you use other root methods like cf-auto-root or flash custom firmwares like CM.
knox is a hardware fuse (at least on the snapdragon cpu) that once tripped cannot be undone as it actually modifies hardware kind-of like burning out a circuit and Samsung checks the flag to see if the device was tampered with and it will void warranty (though they may or may not make an exception depending on the issue like if something was hardware related they might still honor it).
TowelRoot uses a kernel exploit and doesn't mess with bootloaders ..etc , thus keeping knox happy

Thanks for the reply otyg, so can I use towelroot on my 8.4, or does this not work with something like this, or with this OS?

WBFAir said:
Thanks for the reply otyg, so can I use towelroot on my 8.4, or does this not work with something like this, or with this OS?
Click to expand...
Click to collapse
Towelroot only worked on ND1~ND3 Firmware on the tab pro 8.4 then the kernel was patched on newer firmwares--- so if your tab has a newer firmware it won't work anymore without some headaches.
Basically you need to flash the Kernel (not the full firmware) from ND3 root the tab with towelroot then swap the kernel back to the current firmware, and knox should stay at 0x0 .

One of the things that puzzles me is why did they even do this?
Seems that the customization that rooting is needed to be done for, is such a big part of why many buy these things?
Guess there is some that damage things by over clocking or something else, an then rest everything an try to claim warranty, but still gotta be a small amount as apposed to those who buy them as they can do all the software stuff to them.
Seems like they are trying to lock out a good amount of their customer base.

WBFAir said:
One of the things that puzzles me is why did they even do this?
Seems that the customization that rooting is needed to be done for, is such a big part of why many buy these things?
Guess there is some that damage things by over clocking or something else, an then rest everything an try to claim warranty, but still gotta be a small amount as apposed to those who buy them as they can do all the software stuff to them.
Seems like they are trying to lock out a good amount of their customer base.
Click to expand...
Click to collapse
It could be worse, the efuse(s) can be used for all kinds of things like completely locking the bootloader, luckily Samsung didn't go to that extreme

Yeah, I understand.
So by any chance otyg, do you know if regarding my question on anything else it might do, does tripping the knox do anything other then the hardfuse, an the reporting of it?
Does it effect the device in any other way?
Basically I tried the unit I have for just a little bit as I wanted to setup the basics before Xmas an make sure it would work with my WiFi, but all in all the unit ran pretty nice with just the way it was.
So I really even wonder if I want to root it, an then with this Knox thing, its deterring me even more.
But then too, I know some apps just really require it.
So kinda torn.
But if it does something else negative to the device other then what we have already discussed, might just leave it alone for the time being.
Btw, thanks for all the help so far.

There are benefits to rooting like being able to use your sdcard properly , I rooted mine, never tripped knox,
As with all rooting It's a risk if you do trip it it will probably void warranty, it could also brick your device if something goes wrong.
Another common problem I have been seeing is random reboots for people who have a tripped knox flag (this is due to software on the tablet that checks knox and somehow causes reboots, you can disable the software but still troublesome and doesn't work for everyone).
If you really want to root I would go with towelroot method, its the safest and less risk for triggering any knox problems.
you basically update your firmware to the latest version first, extract the kernel from the tar file, download the ND3 firmware extract the kernel, tar the kernel's , flash the nd3 kernel with odin, boot-up , towelroot, install supersu , reboot - switch back to download mode and re-flash the latest kernel)
Read through this thread too, some people have prepared standalone kernels to use if you don't want to do it yourself. you probably need ND3 (or ND1 will work) and K1 if your tablet is the XAR model.
http://forum.xda-developers.com/showthread.php?t=2786800
^ND1 kernel
http://forum.xda-developers.com/gal...320xar1ank1-extracted-stock-firmware-t2954549
^K1 kernel

Thanks greatly otyg, will have to look into this more after the holidays, an thanks so much for the info

WBFAir said:
One of the things that puzzles me is why did they even do this?
Seems that the customization that rooting is needed to be done for, is such a big part of why many buy these things?
Guess there is some that damage things by over clocking or something else, an then rest everything an try to claim warranty, but still gotta be a small amount as apposed to those who buy them as they can do all the software stuff to them.
Seems like they are trying to lock out a good amount of their customer base.
Click to expand...
Click to collapse
Because people mostly don't care and don't know.
If you don't like what they do, then don't support them. Stop buying their products, or buy used if you have to.
Personally, Samsung is the #1 company on my **** list, with Apple being a close 2nd, due to their policies towards their customers.
I only bought my 12.2 Note Pro because nobody else make anything in this class.
I already have Nexus 4 & 7. Xperia. And if I was shopping for a small tablet, I'd get the new Nexus (despite the HTC crappy quality lottery).
I also bought it used/refurbished, not new.

WBFAir said:
Yeah, I understand.
So by any chance otyg, do you know if regarding my question on anything else it might do, does tripping the knox do anything other then the hardfuse, an the reporting of it?
Does it effect the device in any other way?
Click to expand...
Click to collapse
For this device, once you trip Knox you can no longer update firmware through the traditional methods, you have to do it manually through something like Odin or a custom recovery, as far as I can tell. Samsung recognizes that you've "modified" your device and will not let you update through official channels.

gidal said:
Because people mostly don't care and don't know.
If you don't like what they do, then don't support them. Stop buying their products, or buy used if you have to.
Personally, Samsung is the #1 company on my **** list, with Apple being a close 2nd, due to their policies towards their customers.
I only bought my 12.2 Note Pro because nobody else make anything in this class.
I already have Nexus 4 & 7. Xperia. And if I was shopping for a small tablet, I'd get the new Nexus (despite the HTC crappy quality lottery).
I also bought it used/refurbished, not new.
Click to expand...
Click to collapse
I suspect it's to honor their high level contracts (like the govs, and fortune 500 company's) who need to keep the devices secure, knox is a good way to tell the customer their device could have been compromised, unfortunately it does effect normal users like us who like to tweak the devices a little .

otyg said:
I suspect it's to honor their high level contracts (like the govs, and fortune 500 company's) who need to keep the devices secure, knox is a good way to tell the customer their device could have been compromised
Click to expand...
Click to collapse
This is pretty much true, in my understanding. KNOX is aimed at enterprise users (company provided devices) as a means of ensuring the devices are kept in an "approved" or "compliant" configuration. Once a device is rooted, root can be hidden (as well as any number of changes made to the system) so it makes sense for IT departments to want a non-reversible hardware fuse to detect the device has been tampered (mainly by the employees).
Android hasn't had the widest adoption for enterprise use, mainly due to the open nature of the OS. So such security measures are an attempt at changing that perception.
Folks on here have argued that KNOX counter does not void the warranty, and its only purpose if for use along with the KNOX security software. Whether that is 100% true or not, I can't personally say.

Knox allows a device to be setup as two completely separate devices in one. One secured for business use the other for personal use. I tripped Knox immediately on mine when I rooted it.

Can i towelroot and install cm without knockig trox?

Official Recoveries and Kernels that trips you up called KNOX.

Everywhere I read about how people are afraid to trip KNOX, will flashing this trip it.. YES what I understand is that FLASHING anything that is an Unofficial Recovery or Kernel is what will trip this security feature, TRIPPING KNOX will DISABLE SAMSUNG PAY
Samsung Pay relies on the security features of KNOX. Once KNOX is tripped you can't go back.
1st question is how can we make an Official Kernel with ROOT...???
2nd question is what makes it Official to begin with..???????,
no where have I seen any forum discuss how these companies make Official Firmware and kernels, Seems like every phone company can alter Official Firmware and kernels to suit the needs and its still an Official update and does not trip KNOX.
Just curious as to the inner workings on being Official. Would be nice to see a Official Rooted Kernel kind of like the leaked T-Mobile Engineering Kernel but even it was limited in ways.
Anyway about KNOX... trip it.
If you are just using your phone for personal and like custom roms tripping KNOX means nothing and its OKAY.
If your going to use Samsung Pay then step away from ROOT and don't look back. Tripping Knox is not for you.
As far as I can tell the only people who can't root are the people who work for big business and have work related files on their phones, KNOX is going to make a partition and keep all this stuff secret for them so if you rooted your phone and work for lets say the "Department of Defense" chances of you getting fired and your phone destroyed are like 100% so if your the sole owner of your phone and like to tinker with custom roms TRIP KNOX its okay, I just wish we had a way to make Official Firmware and Kernels but I can see problems for big business if we did.

Not to be mean, but you have absolutely no idea what you are talking about. I am only saying that so that anyone else reading this knows that.
"Official Kernel With Root" is not going to happen.
If you trip Knox, you will not be able to use Samsung features such as Samsung Pay. This is important to a number of people.
You really should do some research before posting.

Your not being mean at all but you did not answer either, why is it not going to happen? I would like to know what makes it official and why can't it be done?
I get Samsung pay users, but for those who Root usually are going to flash custom roms and don't care about that feature, if your using Samsung pay then you need KNOX to keep your data secure. I will edit the OP and state the facts for those who don't already know about this.

It it was that easy to work around knox, i guess it wouldnt be that great of a security feature huh? Samsung didnt waste all that time for nothing, theyre protecting your data, and rooting your device makes it vulnerable. Im amazed there was ever a way around it before 5.1.1

lootbooper said:
It it was that easy to work around knox, i guess it wouldnt be that great of a security feature huh? Samsung didnt waste all that time for nothing, theyre protecting your data, and rooting your device makes it vulnerable. Im amazed there was ever a way around it before 5.1.1
Click to expand...
Click to collapse
So true, but I been looking at this 2 ways, as what I read and heard from Samsung about KNOX is you have software which is what the security Suite of apps is all about, it handles all the security features, the KNOX (EFUSE) when rooted or phone is set to custom trips the KNOX Counter which Samsung told me in an email its not connected to the Software Suite for Security, its in place to tell them (Samsung) that the phone has been altered, which VOIDS the WARRANTY and Samsung can refuse to fix your phone. I am trying to get more answers from Samsung about why Samsung Pay stops working if this (Efuse) KNOX Counter is tripped, so far they say the Counter is not related to the software suite. I get no direct answer about it. They don't claim is stops Samsung Pay from working but they really don't tell me why it does stop it either.
UPDATE: " just got an email back from a tech at Samsung, tells me if phone is rooted or custom or if the knox counter is 0x1 you can not install samsung pay, told me the counter is part of the security being used in the Knox Suite." So I guess they are linked then.

Well i see what your getting at i think, but seems like no one has had an issue getting a replacement device with knox tripped. And samsung pay does not even open after tripping when it previously worked. So someone is lying.
Look at all the problems with apple pay. If you dont want your bank account tapped or credit cards maxxed dont break knox. On my opinion its not even that great of a feature, most banks dont support it, and many card terminals wont either until they get updated.

I was just thinking about this myself. I liked having a rooted phone before, but the advantages of having a sandbox on my phone for extra security is nice. You can even use it to have 2 of apps. Like ig or snapchat where u have more than 1 account. Besides some of the little things i miss like xposed, there is no real reason to root the phone, besides maybe tethering. You even can do themes if you want it to look different or a launcher. but can't totally reset your phone after that damn counter.

stldelsol said:
I was just thinking about this myself. I liked having a rooted phone before, but the advantages of having a sandbox on my phone for extra security is nice. You can even use it to have 2 of apps. Like ig or snapchat where u have more than 1 account. Besides some of the little things i miss like xposed, there is no real reason to root the phone, besides maybe tethering. You even can do themes if you want it to look different or a launcher. but can't totally reset your phone after that damn counter.
Click to expand...
Click to collapse
I am still a newbie at this , I rooted my moto razor when I first got it, best damn phone at the time, then I got into Samsung because the camera was better, first Samsung was the S4, what an upgrade from moto... I rooted and tweaked it and never left Android 4.2.2, its still that way, but I wanted a better camera and thought everyone was all happy about lollipop so I got a S6, which it has KNOX, my old s4 has no knox not even in the bootloader, I used triangle away to reset the binary counter but with this S6 I am torn between root or no root, am I going to custom it out or stick around to see if Samsung Pay will actually work out. Rooting does have a purpose but if manufacturers would just let us get rid of bloat maybe the phones could be ours. I also wondered about if rooting would leave your phone open to security risks, I thought you had to grant root access to get into the sandbox.???

I disabled everything i dont use so almost feels like no bloat lol. If you open knox you can set it to be a launcher and have a different set of apps, background and so on. Its nice to keep work separate from regular life. But with root you can achieve a lot of cool things. But after years of rooting and custom roms i am happy with a vanilla phone........ for know haha

What will rooting the S9/S9+ break?

Hi all,
Most of the (advanced) users are already familiar with KNOX on Samsung devices.
Since it is a feature making the device secure in terms of keeping the system unmodified, it is well know that rooting it will trigger the KNOX eFuse and security features using it will stop working for good.
Now my question to which I cannot find a strait answer to is...
What will stop working if KNOX is triggered besides Samsung pay and Secure folder?
Will the fingerprint, IRIS/face unlock... still work?
And are there any more downsides?
Thanks!

dedabrane said:
Hi all,
Most of the (advanced) users are already familiar with KNOX on Samsung devices.
Since it is a feature making the device secure in terms of keeping the system unmodified, it is well know that rooting it will trigger the KNOX eFuse and security features using it will stop working for good.
Now my question to which I cannot find a strait answer to is...
What will stop working if KNOX is triggered besides Samsung pay and Secure folder?
Will the fingerprint, IRIS/face unlock... still work?
And are there any more downsides?
Thanks!
Click to expand...
Click to collapse
I think it breaks S health also if im not mistaken.
Iris, fingerprints etc not affected
sent from my Pixel 2 XL or Note FE

The Health App is pretty effective, so it's a shame to lose it. Mainly for the heart rate monitor, personally. (I have some BPM issues.)
Other than that, not sure.

Will this can be fixed with some patch?
Im coming from xperia, which there always a drm fix patch for newer device so we get the lost features back like x-reality, camera etc.
Also we can relock the BL with the backup so the device can be virgin again in case I want to sell it.
So what about the s9+? Can galaxy phone have the nox and all of its features back if we un-root it?
I have this device for 2 months now but still scared to root it since this is my first samsung device.

fizhsmile said:
Will this can be fixed with some patch?
Im coming from xperia, which there always a drm fix patch for newer device so we get the lost features back like x-reality, camera etc.
Also we can relock the BL with the backup so the device can be virgin again in case I want to sell it.
So what about the s9+? Can galaxy phone have the nox and all of its features back if we un-root it?
I have this device for 2 months now but still scared to root it since this is my first samsung device.
Click to expand...
Click to collapse
No.
Once knox is tripped its permanent and all the things that breaks stay broken.
Theres is an abundance of info on this and its common knowledge for us sammy guys. Hit that search button and start reading up on all the samsung quirks so you dont have any surprises. Your very smart to wait as you have so you dont do something you cant undo!
Sent from my Note 9 exynos, S9 plus exynos, Pixel 2 XL or Note FE

There is a fix for S Health, I have it working on mine by following this thread https://forum.xda-developers.com/s7-edge/how-to/guide-how-to-s-health-devices-knox-t3543306

There is ways around this Knox trip. Also read most ROMs and kernels remove any Knox

bahmonkeys said:
There is ways around this Knox trip. Also read most ROMs and kernels remove any Knox
Click to expand...
Click to collapse
The KNOX that rooting trips and the KNOX that breaks Samsung apps is nothing to do with any ROM, it is a hardware e-fuse
There are workarounds to get some of the apps working again, but once you trip KNOX to 0x1, it's permanent