This question already has an answer here:
Let's say I found a possible vulnerability in a security system. The system has been universally considered sound for years and nowadays is used worldwide.
I am not an expert in security, but there are things that worry me:
- Using a security system believing it is safe is worse then not using one, as I completely rely on its security for whatever reason;
- The system is implemented in different countries, therefore revealing details about why it is not safe may compromise those who do not update their systems straight away;
- I would like to take credit for my work / discovery, but in the same time the discovery may be too big for me;
- There is currently no real alternative to this security system since it has been considered the best for years and nobody expended time and resources to find a better one;
- Revealing problems without bringing a solution seems like saying to the scientific community "Hey, everything you considered safe is not, hurry and find a better solution".
For all the reasons above, I wonder what should someone do in such a clunky situation.
Forgive my vagueness, but I think you understand the reason.