I just TAed an introductory security class. The crypto project involved building a secure channel, and messages were authenticated with HMAC. We authenticated E(msg) || HMAC-SHA-256(msg) by computing HMAC-SHA-256(D(E(msg)) and bytewise comparing it against the sent HMAC-SHA-256(msg). This was based on Practical Cryptography and seemed fairly intuitive to me. How is it drastically insecure? (I fully admit that I don't know practical crypto, hence the conformance to Practical Cryptography.)