I don't understand your gambling point. Could you clarify?

I'm not sure what's unclear. It's an example for how one should not quantify the password (entropy) based on what the password actually is.

@Eclipse The point is that 1111 -- although it "has a pattern" to us, is no more or less likely to occur than any other sequence of four digits. Somewhat related: many people would be deeply disappointed if/when the UK lottery draws the numbers 1 through 6 (which is just as likely as any other set of numbers) as over 10,000 people pick these numbers each week, presumably thinking they'll have the jackpot to themselves since everybody else thinks "number with a pattern are rarer" and won't have picked them.

While the sequence "1111" is just as likely as any other, I would propose that it is a sequence more likely to be guessed by attackers, and therefore you'd be more secure if you avoided it.

To explain my downvote, I don't think that Entropy is that important to the security of 4 digit PINs, what's important is the lock out on the system and not using one of the most common PINs, so that an attacker is unlikely to guess your PIN before the lockout occurs.

I did not introduce the word "entropy" to the question. And I see no special reason to distinguish between 4-digit, 5-digit, 6-digit, 7-digit... Wait... When exactly does entropy become "important"?

@Tom.Bowen89 why would a attacker try 1111 before trying 0184? If you would try to guess a pin, would 1111 be your first try? why?

@Josef second, perhaps, after 1234. Because half the population has IQ below average (by definition), and because one's best chance of guessing a PIN is to assume that the card's owner is from the stupid end of the distribution.

But this is only valid for user changeable pins. If the pin is set by the bank randomly and can't be changed, like it is on all my cards, then this makes no sense. So the obvious choice is to not let users change the pin!

@josef that's really easy. Most PINs are user controlled and changed, therefore an intelligent attacker will choose test the most chosen PIN first. PIN distribution where users can choose is not random across the available options, and the question explicitly mentions the user choosing the PIN.

If this approach was always on, guidelines like "you HAVE to use uppercase/lowercase" should not be used either, because they too take away otherwise possible passwords. But we know the guidelines to have an overall positive effect. Thus, it follows, sometimes forcing the user to "not" pick the easy passwords, is a valid practice.

I may have been a little loose with my terminology in the question. I mainly meant "entropy" in the sense of "resistance to an attacker guessing correctly within the first few tries."

@josef, most banks require you to choose a pin so that there is no way that any employee knows the PIN. Otherwise when your PIN is entered correctly you would just claim that an employee had seen the generated one.

@Josef I wasn't aware there existed non-changeable PINs. But if there are and if I were issued with 1234, I would demand that the issuer re-issued my card with a different PIN, because 1234 is a thief's probable first guess given general knowledge about user-selected PINs and no specific knowledge about this particular card. So the issuer will be advised never to issue 1234, 1111, and other "common" guesses. (A thief who knows it's a 1 in 9970 guess won't be greatly helped thereby).

@RоryMcCune But entropy is very relevant to the question as it is asked: this answer addresses the asker's misunderstanding of what entropy actually is. Given that this misunderstanding has caused them to come to the wrong conclusion (they think that disallowing repeated digits increases entropy when it actually decreases it), I think it's important to address that in an answer. If you think that entropy is the wrong measure, you should downvote the question, not downvote somebody for answering what was actually asked.

@DavidRicherby no, it decreases the maximum possible entropy. Actual entropy depends on what the probability P(pin=1111) is and whether this is equal to every other choice. If it is, they're uniformly distributed and you have the maximum possible entropy. However, if you allow a human to choose the PIN, entropy will be lower. By ruling out those choices that skew the entropy figure (mean self-information) towards low values you (counter-intuitively) increase entropy, at the cost of decreasing maximum possible entropy.

Anyone who actually wanted to break the pin would most definitely use "more common" pins like 1111 or 0000 before randomly guessing — not because those pins are more common from random methods, but because people usually choose pins like that.

@DavidRicherby actually the answer is the one misunderstanding what entropy is (or how to correctly apply it here). Entropy is always relative to a model, and the model any intelligent attacker will use is one in which 1111 is assumed to be much more frequent than 1374 (since they will use some approximation of how often the given number will be chosen by a random person, and most people choose "interesting" numbers). So it does in fact have lower entropy.

Now you can say that a uniformly random choice of PIN guarantees that the expected entropy will be low (ie. the chance of choosing a number with large entropy will be small). That does not mean the actual entropy of a randomly generated number will be low.

@Tgr Can you provide a reference to your definition of entropy? Make sure beforehand, it applies to password strength measurement, not statistical randomness.

Entropy is the logarithm of the number of guesses needed by the attacker. See guessing entropy.

Nothing in this definition hinges on attacker's intelligence or some model. It explicitly states a frequency distribution of the actual password is known. So the fact that digits are unique is known to the attacker. In result the entropy is lower than with a random password. Exactly what I stated in the answer "anything you come up with will have a lower entropy". How is that mistaken?

"the fact that digits are unique is known to the attacker" -- this is false ... an apparent failure of the Sally-Anne test.

No, it's not false. It's a prerequisite for calculating entropy. It might not be known to a real attacker, but OP was calculating the entropy in the question, not asking how to outsmart an attacker.

Yes, it is false ... it's a plain fact that the attacker does not know that the OP is restricting their choice. "not asking how to outsmart an attacker" -- maybe you should try reading the question again: "did I help or hurt myself by doing that?" -- what do you suppose constitutes being hurt or helped? Anyway, that question is rhetorical ... I will not comment further here.