What are some good examples of modifying crypto where flaws are not really obvious? [closed]

I run into some developers from time to time who sometimes try to modify crypto which I end up saying along the lines of "Don't modify crypto." Usually, the question I get is - "OK, tell me why is this bad? How can this be broken?"

My rule of thumb is usually that cryptographic primitives are supposed to be used they way they are told. A slight modification in those primitives or assumptions can break cryptography in a way that cannot be foreseen. However, I am not that really good with spotting flaws on spot. Plus, finding flaws every time I face such modifications is time consuming. I generally like to explain this to people using examples. How can I explain people that they should not modify cryptographic primitives?

• The burden should be on them to prove that their modification is at least as secure as the original primitive. – fkraiem Jul 11 '16 at 1:15
• It should be, but it won't. Security and safety always seem to come after ease of use and ease of implementation. Not to mention "not invented here" syndrome. Safety third! – SAI Peregrinus Jul 11 '16 at 2:31
• EAX Prime is broken but pretty similar to EAX. (I don't know the details) – CodesInChaos Jul 11 '16 at 7:23
• Do they modify primitives themselves (like using custom s-boxes or something) or do they modify higher level constructions? – CodesInChaos Jul 11 '16 at 7:27
• How can I explain people that they should not modify cryptographic primitives? – As that depends on the individual, his/her knowledge range, the protocol and/or algorithm he/she modifies, the way he/she modifies things, etc. answers can be as numerous as the number of potential individual situations/scenarios you run into, where you want to educate him/her/them. That makes the Q “too broad”… with a high chance of also hitting the “primarily opinion based” flagpole. It’s even doubtable if a “one fits all” example for such cases exists. (Note: not saying the already provided examples are bad.) – e-sushi Jul 11 '16 at 13:07