A thief is stealing a password. He knows three constraints; at most how many attempts must he make before he guesses the password? I'm previewing An Introduction to Enumerative Combinatorics by Miklós Bóna.  On page 9 of the preview there is neat problem I'm looking at.
A user needs to choose a password for a bank card.  The password can use the digits 0, 1, ..., 9, with no restrictions, and it has to consist of at least 4 and at most 7 digits.  How many possible passwords are there?
I'm able to solve this part fine, as there are 10 choices for the first digit, 10 for the second, 10 for the third, and so on. Giving us $10^4$ if the password is 4 digits long, $10^5$ if it's 5 digits long, and so on, ending in a total of $10^7+10^6+10^5+10^4=11110000$ possibilities.
A followup question is this:
Let us assume that a prospective thief tried to steal the code of the card.  As the rightful user typed in the code, the thief observed that the password consisted of five digits, did not start with zero, and contained the digit 8.  If the thief gets hold of the card, at most how many attempts will he need to find out the password?
As pointed out in the text, it is long and cumbersome to count all the five-digit integers that contain eight, because we would recount several elements several times; for instance, we would count $82883$ as a five-digit integer where the first digit is 8, and we would count it again as a five digit integer where the third digit is 8.  The book suggests taking all five-digits integers, and removing those that don't contain 8.
This is easy enough, there are $9*10^4=90000$ five digit integers.  Those that don't contain eight have 8 choices for the first digit, and 9 for all the rest, giving us a total of $8*9*9*9*9=52488$ five-digit integers that do not contain the number 8.  So the answer to the problem is $90000-52488=37512.$
My actual question begins here.  Suppose we do not want to use the "total minus what you don't want method" to solve this.  What would we do then?  What could we do to count what we do want then remove the duplicates?

You could look at 5 cases, depending on where the first 8 appears.
Since the first digit is not 0, and since the digits preceding the first 8 are not an 8, this gives
$\underbrace{1\cdot10^4}_{\text {digit 1}}+\underbrace{8\cdot1\cdot10^3}_{\text {digit 2}}+\underbrace{8\cdot9\cdot1\cdot10^2}_{\text {digit 3}}+\underbrace{8\cdot9^2\cdot1\cdot10}_{\text {digit 4}}+\underbrace{8\cdot9^3\cdot1}_{\text {digit 5}}=37, 512$ passwords.
