When I first started learning about installing custom ROMs like LineageOS, it wasn't long before I was made aware of the security implications involved, particularly with unlocking the bootloader. The rooting is not as big an issue in itself once the custom ROM installed from what I know. The ROMs come with things preinstalled and configured the way they should be. Rooting more risky for security on a non-flashed device, but in the case of installing a custom ROM, it's still important to know the implications of leaving the bootloader unlocked.
The device I had at the time was a Galaxy A20 and not officially Lineage supported. Being my first Galaxy device, I noticed this new feature set called Knox. From what I know about Knox it is a hardware-based security scheme. This sounded like something pretty fail-safe to me when I first heard about it, and something that would probably be better left alone.
When I first learned that rooting has the side affect of affecting your device's security, in the particular case of my Galaxy device, Samsung Knox was one of the first things that crossed my mind. I can only assume that rooting the device would nullify most of the benefits of the Knox security platform.
It was at this point I decided that, as much as I may want to de-Google my phone, until I upgrade to an officially supported Lineage device, a custom ROM would probably not be ideal for my case with the A20 running Samsung Knox, due to the security implications involved.
For context, I'm a longtime Tracfone user and have never invested much into my mobile device. The last couple phones I've owned have had enough limitations and missing features to persuade me to upgrade early. I finally decided to step it up and upgrade to a Galaxy S10e. This device is officially supported by LineageOS, but being a Galaxy model, it still has Samsung Knox. I am excited to finally own a custom ROM officially supported device, but again, my primary reason for upgrading was the storage space and feature set. I'm still trying to weigh the benefits between testing Lineage and giving up Knox.
Perhaps a Pixel with Graphene would be a better device to de-Google but I am new to custom ROMs so between what I learned about having an unlocked bootloader and the benefits of running Samsung Knox, I've sort of reached a point of needing more info on Knox. I don't really know the specifics of what I'd be giving up by rooting a Knox device. I am aware of some of the soft features such as secure folder and secure WiFi. That's about it though. Some reviews even indicate it might not be all it's played up to be. But this page from Samsung's website has me pretty sold on its ability to block advanced attack methods by implementing government grade-security. Reminds me of some new PC features like secure boot and core isolation.
I need to ensure my device's data is protected and safe if lost or stolen. Some of what I've read has made me wonder if this is even a use case for Knox. It seems like it according to Samsung though. It then occurred to me, "can I 're-lock' the bootloader, so to speak?" If I were to do this, would it be at all comparable to my formerly Knox-secured device? Is it even possible?
That's when I discovered that Android has something called user-settable root of trust. The problem with locking the bootloader after flashing a custom ROM is the risk of the bricking the device. From what I can tell, this is where user-settable root of trust comes in. On certain Android devices, the user can add the new ROM as a valid signature when the device boots.
So in summary it appears one thing I can be sure of is that if I root a Galaxy device, I will be giving up Samsung Knox because the Knox Warranty Bit will be tripped. But perhaps there is a way to either encrypt the device or implement user-settable root of trust, depending on the device. Would such a device keep its data secure if lost or stolen and how well would this compare to stock ROM running Knox?