Marriott and Citi and any other company whose security policy has stupid special character requirements - have ALL special characters available. You not only screw over anyone whose passwords exclude those special characters, you make it easier to brute force by excluding those characters! Those policies suck!