dotKom/onlinepetition — comment on commit 0296d6dbb68696a38af4acaaebcd2244a4178f89
File: onlinepetition/petition/models.py line 103
By dagolap:

IMO it's okay, because:

1: The activation key is unique due to the inclusion of sign date and email anyways. Which is the only important aspect here.
2: "Breaking" the activation code can only allow you to verify one email, one time. No passwords can be found, so it's really no encrypted data that needs processing here anyways.
3: Using the title as part of the hashing process is no use anyways since the source is openly available on github and the title of the petition is predictable.
4: The only (somewhat) unpredictable value in the activation code is the signed date, which is being retained.

Personally I think a better solution would be to just generate a random, and much shorter, activation code to keep the confirmation email more readable. No need for salting etc. here.