A while ago I worked on a web application where users could buy tickets. Due to the way our client\'s processes worked, what you effectively got as a result of your purchase
GUID
s are generated by a very well known algorithm. There is no randomness built-in as well known values such as network card ID's and timestamps are used to generate them.
They should never be used as a means of security.
EDIT
It appears newer version of the GUID/UUID
algorithm no longer use hardware address for parts of their values and instead use pseudo-random numbers. But these are not truly random and still should not be used for security critical applications.