[phw]

An unrelated but practical example: I used to play a competitive ski racing game. You would race a course and upon finishing, your client sent the locally-determined finishing time back to the server, where it would end up on the global leader board. It was possible to modify the finishing time in-flight, and set it to whatever you wanted because the server had no way to know if a client was lying. To be fair, I did not succeed because the time was still "protected" by a hash whose input I could not be bothered to figure out.