Hasan Kalyoncu University Bilişim Teknolojileri Hasan Kalyoncu University
TREN

Password Policy and Reset

Institutional account security is one of the core controls implemented by Hasan Kalyoncu University Information Technology within the ISO/IEC 27001:2022 Information Security Management System framework. All users are obligated to comply with this policy.

1. Password Complexity Requirements

  • Must be at least 8 and at most 50 characters long (12+ characters recommended).
  • Must contain at least three of these four types: uppercase letter (A-Z), lowercase letter (a-z), digit (0-9), symbol (e.g. . * ! _ # $).
  • The following characters cannot be used: @ ^ - % ' & < >
  • Must not contain your first name, last name or username (student number / name.surname).
  • Common patterns and sequential characters (123456, abcdef, qwerty, password) are rejected.

2. Password History and Failed Logins

  • The last 5 passwords cannot be reused.
  • After 5 failed login attempts, sign-in is temporarily blocked for 15 minutes.
  • Changing your password on first login is not mandatory; we recommend changing the initial password given to you via the Portal.
Warning: Do not use the same password across multiple platforms (banking, social media, HKU account). Using a password manager (Google Password Manager, Bitwarden, etc.) is recommended.

3. Password Reset Methods

A. Reset It Yourself on the Portal (Recommended)

Step-by-step guide with screenshots (Turkish): Şifremi Unuttum: Adım Adım

  1. Go to portal.hku.edu.tr and click Forgot Password (Şifremi Unuttum).
  2. Choose With Microsoft (if you have Authenticator) or With SMS.
  3. For SMS, enter your username; type the 6-digit code sent to your registered mobile phone.
  4. Enter your new password twice. The new password works for Portal, LMS, e-mail, Wi-Fi, Office 365 and VPN.

If the registered phone is not yours, update it in OBS (obs.hku.edu.tr); changes are synced every 30 minutes, so try again after 30 minutes.

B. Request via the Help Desk

  1. E-mail destek@hku.edu.tr from your university address, or open a request on the Portal under Destek (Support).
  2. Provide your student number or staff personnel number.
  3. The help desk verifies your identity with an SMS code sent to your registered phone.
  4. The help desk will never ask for your password; never send it by e-mail.

C. In-Person Identity Verification

Users who cannot access their recovery information may visit the IT office in person with their HKU ID card to have their password reset.

4. Signs That Your Account Has Been Compromised

  • Login warnings from an unknown device or location.
  • Emails in your Sent Items folder that you did not send.
  • Unexpected messages in your inbox that have been deleted or marked as read.
  • Unauthorized changes to your recovery phone number or alternative email address.
  • Files in Drive that have been deleted or had their sharing permissions changed.

5. Best Practice Recommendations

  • Keep two-factor authentication (2FA) enabled.
  • When saving your password in a browser, store it only in your institutional profile.
  • Never share your password with anyone, under any circumstances, through any channel. IT staff will never ask for your password.
  • Always sign out after each session on shared computers.
Share