I'm having a debate with a coworker right now about how to design an invitation system. The idea is that the mobile app will be able to send an invitation link to, say, a Whatsapp group, and people from that group will be able to use the link to join our system and be automatically enrolled into a group on our system. The coworker suggests the link format be along the lines of:
I said that this was insecure because someone could just change the group ID and register with our system (which is marketed as, amongst other things, 'secure'), having the system join them into any group they can guess the ID for. This system is going to be used by medical professionals. I suggested that the "group ID" should be encrypted, and he responded that there's no point because someone could just reverse engineer the app and generate their own encrypted group ID anyway.
I then suggested using a server-generated ID for the invitation ID, and storing the group ID in which to enrol the user upon registration in the server's database, to which he responded that that too could be hacked, and that it would just be harder.
What's the best practice for this sort of "invite link" in terms of security? It seems to me that the coworker has a very blase attitude towards things, and that whilst technically the system could be hacked, it's still worth making it harder to hack.