Should I have a repeated digit in a $4$-digit pin code? A small argument my colleague and I were having...
Say I've got a $4$-digit security code on my burglar alarm, and I'm too lazy to ever change it.  Over time, the digits involved will become worn.
If I've used $4$ different digits (as is common, eg $1357$), then an attacker, knowing those are the digits in the code, needs (if I'm right!) $24$ goes to try all combinations.
If I've repeated a digit (eg, $1317$), the attacker just knows $1$, $3$ and $7$ are used (assume that all wearing is indistinguishable).  How many different possible $4$-digit codes are possible, using each digit at least once?  I say it's more than $24$, my colleague is convinced otherwise.
Bonus kudos for generalizing the problem to knowing $k$ digits in an $n$-digit pin. ;)

Your question of "using each digit at least once" is kind of confusing, because you should emphasize that there are nonetheless $3$ different digits involved, all of which are known to the attacker.
Having emphasized this, the attacker has a total of $36$ possible combinations:
 Digit #1 occurs | Digit #2 occurs | Digit #3 occurs | Combinations
-----------------|-----------------|-----------------|--------------
 1 time          | 1 time          | 2 times         | 12
-----------------|-----------------|-----------------|--------------
 1 time          | 2 times         | 1 time          | 12
-----------------|-----------------|-----------------|--------------
 2 times         | 1 time          | 1 time          | 12


Each case can be calculated in any of the following ways:


*

*$\binom41\cdot\binom31\cdot\binom22=12$

*$\binom41\cdot\binom32\cdot\binom11=12$

*$\binom42\cdot\binom21\cdot\binom11=12$

