diff --git a/devdocs/todo.txt b/devdocs/todo.txt
index 2bf1594a..29a587fe 100644
--- a/devdocs/todo.txt
+++ b/devdocs/todo.txt
@@ -397,6 +397,8 @@ BUNDLING
 	- How hard is this to support in AyaNova?
 	- What about apps like Authy?
 	- It might be important to enable this for ops and biz accounts? Or at least be an option?
+	- https://blog.trailofbits.com/2019/06/20/getting-2fa-right-in-2019/
+	- https://news.ycombinator.com/item?id=20232164
 
 - LETS ENCRYPT
 	- https://www.humankode.com/ssl/how-to-set-up-free-ssl-certificates-from-lets-encrypt-using-docker-and-nginx