In our rails model, we generate a SHA1 string based off of the user’s email address, the random obfuscated email address that we generate, and a salt.

Why people still do this, when HMAC is even easier to use? http://www.ruby-doc.org/stdlib-1.9.3/libdoc/digest/rdoc/Dige...

It also seems like the salt here is not actually a salt, but a secret key.

Edit:

    @listing = Listing.find_by_confirmation_code(params[:code])

I'm confused. If you store confirmation code, and lookup users by it, why it should be SHA1 instead of a random string?