Samsung Knox - what is it and how does it affect my custom roms?

[Downunder35m]

Was not 100% what the best section for it is, so I decided here is as as good as any.

It all started on my SG4 a while back when I rooted it on the stock 4.2.2 system.
There were so many available solutions that I decided to read a bit before proceeding - after all that damn phone costs a few bucks...
Turned out there was no obvious problem to find so I used the first solution I found and it worked without any flaws.
Now some models already can update to the 4.4.2 Android and I was wondering what might be in store for my model.
To my surpise the OTA update refused stating my device would be modified.
Mind you I only rooted and never installed a custom rom or recovery!
A bit of searching led me to "Triangle Away" and it also confirmed my device is genuine (censored)....
In an last attempt I decided to use Kies and ask for an update which was offered and performed with no problems.

First thing I noticed is that some of my programs refused to work.
Turned out the new system uses other security measures and a slightly different folder structure, so everything I outsourced to the SD and some minor programs failed to work.
Of course this was frustrating enough to do some more digging...
Seems the only way around is to do a "clean install" meaning you wipe all after making a backup, do the update and re-install your programs and settings.
Ok, I thought do it properly but then I stubled opon a thread mentioning "Knox" and warranty problems!
Samsung wanted a bigger share of the market by making sure their devices can be used in secure office enviroments, like the Apple and HTC devices.
This meant implementing a secure bootloader and a tamper proof system.
Part of this is a flag for the Knox system - this flag will be set if you install a custom recovery or firmware on a device already using the new system.
With the flag set the Knox system is useless and there are also claims that Samsung refuses the warranty if that flag is set.
Don't confuse it with the "custom" flag that only tells Samsung you installed something non genuine - till today the Knox flag is permanent meaning once set to 0x1 instead of 0x0 your device can't be used in secure enviroments anymore.
If you are just a normal user this is no problem except for the warranty part, but if you would like to use your phone in any gouvernment or security minded company they will tell your phone can't be used for it.
Having said that you will have no problem unless you need the Knox features for your work.

But what if you already updated and without the need for a custom rom or recovery you still need root access to your device?
As long as you don't need Knox there are still plenty of options available - but do your digging as some tools are deemed to collect your Imei and EFS data (possibly for cloning).
However, there is a root exploit (saferoot.zip) - Google it
This exploit can root your device without setting the Knox flag but only on stock roms that came OTA or with Kies!
Even installing a genuine rom meant for your model using Odin will set the Knox flag!

You might have noticed that Ebay and other sites are being "flooded" by late Samsung models.
More and more users get rid of the phones now because they don't like the way Samsung handles the Android open source policies.
After all it should be up to you what you like to install on your phone and how you install it.
If you want to know if the Knox flag is already set to 0x1 simply start the phone in download mode.
In the top left corner you will see the info you need - if it says 0x1 instead of 0x0 for Knox the phone is useless for secure uses and most likely Samsung will refuse the warranty on the device if you happen to have a defect.
So be aware before you buy a "bargain" on Ebay and ask for the download mode and a pic of the screen to confirm the device is still worth the price.
Again: If you don't have a need for Knox you have nothing to worry except the warranty.