[dfawcus]

My example was using cut'n'paste, then cmp, so the full 40 char hash. I don't try comparing those things manually.

As I said trivial to prove valid; and since I was actually reading, using, and compiling the code, quite difficult to achieve a collision in the circumstances.

[zaarn]

Then just fake the first and last characters, not much of an additional challenge, few people compare all characters, they compare the first and last few. I bet that would have even caught you unaware in some moments.