Preserving privacy for free: Efficient and provably secure two-factor authentication scheme with user anonymity

•We show a number of latest privacy-preserving two-factor schemes are problematic.•De-synchronization attack is a serious threat to anonymous schemes and deserves attention.•We present a new scheme to overcome the identified flaws with nearly no additional cost.•Security and privacy provisions of our scheme can be proved in a widely accepted model.