The server would not be able to verify a changing hash without knowing the password