How do you stop an attacker from just changing a hash?