It's a mathematical thing based on the algorithms used to encrypt the passwords. Basically, eight characters gives you the longest time before it starts to repeat itself.
Or something like that. Like I said, it was a while ago that I read the article, and much of it was further over my head than I wanted to reach
