Two-factor authenticated key exchange (2fAKE) protocol requires a client to provide two authentication factors to authenticate itself and establish a shared session key with a server, thus providing double-insurance.     In this work, we focus on 2fAKE with biometrics and passwords serving as the two factors. Such 2fAKE might be the most convenient one for the client. However, the use of biometrics and passwords may increase the risk of their leakage. To protect the privacy of biometrics and passwords, we formalize an enhanced security model for 2fAKE. Specifically, we require zero-knowledge on the biometrics, namely the server database as well as the protocol transcripts do not reveal any information about the biometrics. As for passwords, we require that the compromise of the server database does not leak the passwords of clients.     We then propose a generic construction of 2fAKE, which enjoys both great convenience and enhanced security. It does not require the client to store any secrets, does not store the passwords in plain in the server database, and achieves zero-knowledge on the biometrics throughout the protocol. By instantiating the generic construction with post-quantum secure building blocks, we immediately get concrete 2fAKE protocol with enhanced security from post-quantum assumptions, which provides even stronger security guarantees. The experiments show that our 2fAKE instantiation achieves high efficiency, where the server stores just 3.1 KB in database for one client, the communication is only 3 rounds and costs 4.3 KB, the client runs in 25 ms and the server runs in only 0.2 ms.