Not to mention that if you're not doing any sort of authentication of the conversation with the other end there's nothing to stop someone able to muck with the data in transit from mucking with the MD5 as well.