Add this to the list of incompetent “secure” web technologies: Verified By Visa, which restricts passwords to 8-15 chars, with NO special characters.