On: Hash collisions and exploitations – Instant MD5 co...

[dingosity]

you don't know if it's the hash or the data that's been tampered with. so if the stored or transmitted hash doesn't match the computed hash, you reject it.

[nwellnhof → dingosity]

But if the hash matches, you can't know whether an adversary tampered with the data and simply updated the hash to match.