In our rails model, we generate a SHA1 string based off of the user’s email address, the random obfuscated email address that we generate, and a salt. Why peop

In our rails model, we generate a SHA1 string based off of the user’s email address, the random obfuscated email address that we generate, and a salt. Why people still do this, when HMAC is even easier to use? http://www.ruby-doc.org/stdlib-1.9.3/libdoc/digest/rdoc/Digest/HMAC.html http://www.ruby-doc.org/stdlib-1.9.3/libdoc/digest/rdoc/Dige... It also seems like the salt here is not actually a salt, but a secret key. Edit: @listing = Listing.find_by_confirmation_code(params[:code]) I'm confused. If you store confirmation code, and lookup users by it, why it should be SHA1 instead of a random string?