Manual:$wgInvalidUsernameCharacters

Details
Characters to prevent during new account creations.

The @ sign is prohibited by default, because MediaWiki uses it internally for users that have their account in another wiki (interwiki users).

The : sign is prohibited because usernames' validity in different wikis differs due to different namespace and interwiki configuration.

If you allow the "@" in usernames, you should also set .

Otherwise you won't be able to give users with an "@" in the username different permissions using the normal way (though permissions can still be set via user id).

However, you are free to allow the ":" in usernames as long as you don't run multiple wikis with shared database or Extension:CentralAuth, and you don't create new namespace or interwiki prefixes which make exist username invalid.

This is used in a regular expression character class during registration (regex metacharacters like / are escaped).

Example
In case user names containing @, # and € should be prevented, the following setting is used: