Ask HN: How Long to Wait with Responsible Disclosure?

So, I found a pretty serious vulnerability in a major website. I won't go into great detail, but the vulnerability makes it terribly easy for a malicious user to harvest usernames & passwords in plaintext.

The offending site has not published a responsible disclosure agreement anywhere. I sent them an email letting them know about the issue, and would like to give them time to respond to/fix the issue.

How long would you usually wait before publicizing something like this? I don't want to throw them under the bus, but I also recognize that public pressure usually speeds up the response time.