diff --git a/SessionId.cpp b/SessionId.cpp
index daa3a0e..764f03f 100644
--- a/SessionId.cpp
+++ b/SessionId.cpp
@@ -1,17 +1,28 @@
 #include "SessionId.h"
-#include <openssl/ssl.h>
+#include "Exception.h"
+#include <openssl/rand.h>
 
 namespace jet {
 
+   // Previously SHA1("JETSESSION" + time(0)) - deterministic and
+   // guessable from the wall-clock second alone (two sessions started in
+   // the same second got the IDENTICAL id, and an attacker doesn't even
+   // need a collision - the whole value is computable from a public,
+   // narrow-range input). Confirmed via a real test: two separate
+   // jet-2.0 runs with no cookie, back to back, produced the same
+   // "fresh" session id. Replaced with 20 bytes straight from OpenSSL's
+   // CSPRNG - RAND_bytes() is already available via libcrypto, which
+   // every jet-2.0/jetc build already links against for other reasons.
    SessionId::SessionId() {
-      unsigned char hashit[64];
-      unsigned char hash[SHA_DIGEST_LENGTH];
+      unsigned char randomBytes[20];
+      if(RAND_bytes(randomBytes, sizeof(randomBytes)) != 1)
+	throw coreutils::Exception("failed to generate a random session id.");
       setSize(40);
-      sprintf((char *)hashit, "JETSESSION%ld", time(0));
-      SHA1(hashit, strlen((char *)hashit), hash);
       sprintf(getData(), "%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x",
-	      hash[0], hash[1], hash[2], hash[3], hash[4], hash[5], hash[6], hash[7], hash[8], hash[9],
-	      hash[10], hash[11], hash[12], hash[13], hash[14], hash[15], hash[16], hash[17], hash[18], hash[19]);
+	      randomBytes[0], randomBytes[1], randomBytes[2], randomBytes[3], randomBytes[4],
+	      randomBytes[5], randomBytes[6], randomBytes[7], randomBytes[8], randomBytes[9],
+	      randomBytes[10], randomBytes[11], randomBytes[12], randomBytes[13], randomBytes[14],
+	      randomBytes[15], randomBytes[16], randomBytes[17], randomBytes[18], randomBytes[19]);
    }
-   
+
 }