nunthu's blog

In recent years, NCIT has introduced face recognition via the eFaas mobile app as an alternative to in-person verification. While this method adds convenience by eliminating the need for physical visits, it also raises important questions:

🔹 Is it as secure as in-person verification? 🔹 Does it provide the same level of confidence in identity authentication?

The Shift from Verification Levels to a Simple "Verified Yes/No"

Previously, eFaas had multiple verification levels, with the highest (Level 300) requiring users to verify their identity in person, have their photo taken, and sign an agreement. This ensured a high level of confidence in the user's identity.

However, eFaas has now transitioned to a simplified "Verified Yes/No" model, with face recognition via the mobile app becoming the new primary verification method.

Concerns with Face Recognition as the Sole Verification Method

While face recognition brings ease of use, there are some concerns with relying solely on this method:

✅ Liveness Detection – Is it effectively implemented? Without proper liveness checks, spoofing attacks using photos or videos could compromise security.

✅ Accuracy & Matching Issues – There have been reports of users struggling to get verified via face recognition. Additionally, twins may be mistaken for the same person, raising concerns about the system’s accuracy.

✅ Foreign Nationals & eFaas – Currently, face matching is only available for Maldivian citizens, as the system only contains local ID photos. This leaves foreign work permit holders unable to verify via this method.

An Alternative Solution: Remote Video Call Verification

Some banks abroad and other organizations tackle these issues by using live video call verification instead of (or in addition to) automated face recognition. A live agent can:

📌 Match the user’s face in real time 📌 Check for liveness (blinking, head movement, etc.) 📌 Request the user to show their national ID or passport

This approach offers a balance between security and convenience, especially for those unable to verify via the mobile app.

Final Thoughts

Face recognition is a great step forward, but should it be considered equivalent to Level 300 in-person verification? In my opinion, it should fall somewhere around Medium+ (250)—convenient, but not the highest level of identity assurance.

As digital identity verification evolves, a hybrid approach combining face recognition, video verification, and other security measures might be the best way forward.

When customizing the discriminator that #EntityFramework (EF) Core uses for inheritance with Table per Hierarchy (TPH), you have to specify a value for each type (including base type) - using .HasValue<Type>(value)

With more and more e-government service portals being launched, which required citizens to register and remember a password, eFaas was introduced to become the common login or password used in all of them. 

However, eFaas was also designed to be more than just a single password for all e-government services. It was to become the new digital identity with which  Maldivian citizens (or residents, such as work permit holders) could transact online and request for services. 

In order to make registration for an eFaas account easy but also be able to provide confidence on the actual identity of the user, a verification level was attached to it. A citizen could register online within minutes, but the eFaas account would have it’s lowest verification level at that point. The verification level of the eFaas account could be increased via different methods of verification and it is left up to the e-government service provider to decide their minimum requirement for the verification level of a user applying for their services. This provides a flexible model which can be expanded in the future when different needs arise. 

eFaas verification levels are: 

100 - Low (National ID Card Number & Serial number verified from DNR)  200 - Medium (Mobile phone number used is registered in the name of person) 250 - Medium+ (Verified in person at an eFaas verification authorized center) 300 - High (Verified in person & a user agreement is signed etc) 

If a user with verification level 300 signs into a e-government portal, then the service provider can accept service applications and provide the service with full confidence that the user is actually the person who the user claims to be.  

Request.GetOwinContext().Authentication.SignOut(Microsoft.AspNet.Identity.DefaultAuthenticationTypes.ApplicationCookie);

It's been 8 years since the launching of eFaas, the digital identity for transacting with Maldives e-Government services online, in November 2012 by National Centre for Information Technology (NCIT). 

eFaas's meaning was meant to be (in dhivehi language) : e-government hidhumaithah dhey portal thaka vannan beynunkuraa electronic faas 

eFaas has survived and had some development (such as OpenID Connect authentication) but sadly has not reached its full potential. eFaas was based on SingPass used in Singapore which has seen continuous development and upgrades over the years since eFaas was launched. For example, SingPass now has a mobile app which allows 2-factor authentication in addition to 2-factor authentication via SMS OTP. They have also introduced Face verification and ability to electronically sign documents with it. They have gone beyond digital access and now SingPass Mobile app can be used by users to prove their identity and provide personal information when getting services over the counters. 

New features in SingPass are excellent ideas for bringing into eFaas. For example an eFaas Mobile app can be used to centralize all e-gov related notifications, provide extra security with 2-factor authentication etc. eFaas can be linked with DNR (Department of National Registration) records to allow fingerprint + face verification. 

I believe eFaas can complement our national ID card and be used to prove identity, similar to SingPass, using a Mobile app with biometric verification. 

https://github.com/dotnet/AspNetCore.Docs/blob/master/aspnetcore/security/authentication/social/additional-claims/samples/3.x/ClaimsSample/Areas/Identity/Pages/Account/ExternalLogin.cshtml.cs 

IIS Express has default ssl port range  44300 and 44399