True, but I believe the point is still valid.  Given knowledge of cryptographic hashes, and ignorance of HMAC, it is a perfectly reasonable assumption to use a hash in this way.  I think that's a rather common situation, and outcome.<p>And, blindingly obvious in hindsight (I have definitely heard of HMAC before, at least) but new to me too.