Proximity-based device access

1. A method comprising:

receiving, by a first electronic device and over a wireless communication link, a message from a second electronic device in proximity to the first electronic device, the message being received by the first electronic device while the first electronic device is in an access-restricted state in which access by a user is restricted, wherein the access-restricted state includes an interface of the first electronic device being locked while a user session for the first electronic device is active; and

while the first electronic device is in the access-restricted state and before user input is provided to the first electronic device by the user following entry of the second electronic device into the proximity to the first electronic device:

determining, by the first electronic device, that the second electronic device has been previously associated with the first electronic device as an authentication factor for accessing the first electronic device;

receiving, by the first electronic device, an encrypted form of a password from the second electronic device over the wireless communication link;

determining, by the first electronic device, the password from the encrypted form of the password; and

initiating a transition of the first electronic device from the access-restricted state to an accessible state in which the first electronic device can be accessed by the user by providing, by the first electronic device, the password to an operating system executing on the first electronic device to unlock the first electronic device, wherein the password is provided such that the first electronic device automatically transitions from the access-restricted state to the accessible state without user input to the first electronic device.

2. The method of claim 1 , wherein the wireless communication link is a direct wireless communication link.

3. The method of claim 2 , wherein the direct wireless communication link is a Bluetooth communication link, and

wherein determining that the second electronic device has been previously associated with the first electronic device as an authentication factor for accessing the first electronic device comprises determining that the second electronic device has previously been paired with the first electronic device using Bluetooth communication.

4. The method of claim 2 , wherein the direct wireless communication link is a Bluetooth communication link, and

wherein determining that the second electronic device has been previously associated with the first electronic device as an authentication factor for accessing the first electronic device comprises communicating, by the second electronic device and with the first electronic device, using a link key established during pairing of the second electronic device with the first electronic device using hardware-level Bluetooth pairing managed by an operating system of the first electronic device.

5. A method comprising:

receiving, by a first electronic device and over a wireless communication link, a message from a second electronic device in proximity to the first electronic device, the message being received by the first electronic device while the first electronic device is in an access-restricted state in which access by a user is restricted, wherein the wireless communication link is a direct wireless communication link, and wherein the direct wireless communication link is a Bluetooth communication link; and

while the first electronic device is in the access-restricted state and before user input is provided to the first electronic device by the user following entry of the second electronic device into the proximity to the first electronic device:

determining, by the first electronic device, that the second electronic device has been previously associated with the first electronic device as an authentication factor for accessing the first electronic device, comprising determining that the second electronic device has previously been paired with the first electronic device using Bluetooth communication;

receiving, by the first electronic device, an encrypted form of a password from the second electronic device over the wireless communication link;

determining, by the first electronic device, the password from the encrypted form of the password; and

initiating a transition of the first electronic device from the access-restricted state to an accessible state in which the first electronic device can be accessed by the user by providing, by the first electronic device, the password to software executing on the first electronic device to enable access to the first electronic device, wherein the password is provided such that the first electronic device automatically transitions from the access-restricted state to the accessible state without user input to the first electronic device.

6. The method of claim 1 , wherein receiving the encrypted form of the password, determining the password, and providing the password are performed by an agent executing on the first electronic device along with an operating system of the first electronic device, the agent having permission to provide passwords to the operating system of the first electronic device; and

wherein providing the password to software executing on the first electronic device to enable access to the first electronic device comprises passing, by the agent executing on the first electronic device, the password to the operating system of the first electronic device.

7. The method of claim 1 , further comprising, in response to providing the password, providing access to the first electronic device, wherein providing access comprises unlocking a user interface of the first electronic device, initiating a new user session on the first electronic device, resuming an existing user session on the electronic device, authenticating a user to the first electronic device, or logging a user into a user account.

8. The method of claim 1 , wherein the first electronic device is a computer, and the second electronic device is a mobile phone.

9. The method of claim 1 , further comprising, in response to providing the password, providing a user access to a user interface of the first electronic device that was unavailable prior to providing the password, the access being provided without user input being entered to the first electronic device between receiving the message from the second electronic device and providing access to the user interface.

10. The method of claim 1 , further comprising:

in response to receiving the message from the second electronic device, determining a signal strength of the wireless link between the first electronic device and the second electronic device; and

determining that the signal strength satisfies a threshold level, wherein the threshold level corresponds to sufficient proximity to allow access to the first electronic device based on presence of the second electronic device;

wherein providing the password is based at least in part on determining that the signal strength satisfies the threshold level.

11. The method of claim 10 , further comprising:

in response to receiving the message from the second electronic device, identifying, based on the message, the second electronic device or a user associated with the second electronic device; and

accessing data indicating a signal strength threshold designated for the second electronic device or a user associated with the second electronic device, wherein the signal strength threshold indicates a signal strength that represents a user-selected level of proximity for providing access to the first electronic device;

wherein determining that the signal strength satisfies the threshold level comprises determining that the signal strength satisfies the signal strength threshold.

12. The method of claim 1 , wherein receiving the encrypted form of the password comprises receiving an encrypted password that was encrypted using a public key of the first electronic device; and

wherein determining the password comprises decrypting the encrypted password using a private key of the first electronic device that is stored at the first electronic device.

13. The method of claim 1 , further comprising:

after providing the password, determining a signal strength of the wireless link between the first electronic device and the second electronic device;

determining that the signal strength satisfies a threshold level, wherein the threshold level corresponds to distance to automatically restrict access to the first electronic device; and

restricting access to the first electronic device in response to determining that the signal strength satisfies the threshold level.

14. The method of claim 13 , further comprising:

identifying the second electronic device or a user associated with the second electronic device; and

accessing data indicating a signal strength threshold designated for the second electronic device or a user associated with the second electronic device, wherein the signal strength threshold indicates a signal strength that represents a user-selected distance level for automatically restricting access to the first electronic device;

wherein restricting access to the first electronic device comprises restricting access to the first electronic device based on determining that the signal strength satisfies the signal strength threshold.

15. The method of claim 1 , further comprising:

in response to determining that the second electronic device has been previously associated with the first electronic device, identifying a user credential corresponding to association of the second electronic device with the first electronic device, the user credential being issued to a particular user associated with the second electronic device; and

determining that the user credential corresponding to the association is valid;

wherein providing the password is performed in response to determining that the user credential corresponding to the association is valid.

16. The method of claim 1 , further comprising:

in response to determining that the second electronic device has been previously associated with the first electronic device, identifying a user credential corresponding to association of the second electronic device with the first electronic device, the user credential being issued to a particular user associated with the second electronic device;

identifying, by the first electronic device, a security policy corresponding to the user credential, the security policy specifying one or more conditions that limit use of the user credential while the user credential is valid and unexpired; and

determining, by the first electronic device, that the one or more conditions specified in the security policy corresponding to the user credential are satisfied;

wherein providing the password is performed in response to determining that the one or more conditions specified in the security policy corresponding to the user credential are satisfied.

17. One or more non-transitory machine-readable storage media storing software comprising instructions that are operable, when executed by one or more processors of a first electronic device, to cause the first electronic device to perform operations comprising:

receiving, by the first electronic device and over a wireless communication link, a message from a second electronic device in proximity to the first electronic device, the message being received by the first electronic device while the first electronic device is in an access-restricted state in which access by a user is restricted, wherein the access-restricted state includes an interface of the first electronic device being locked while a user session for the first electronic device is active; and

while the first electronic device is in the access-restricted state and before user input is provided to the first electronic device by the user following entry of the second electronic device into the proximity to the first electronic device:

determining, by the first electronic device, that the second electronic device has been previously associated with the first electronic device as an authentication factor for accessing the first electronic device;

receiving, by the first electronic device, an encrypted form of a password from the second electronic device over the wireless communication link;

determining, by the first electronic device, the password from the encrypted form of the password; and

initiating a transition of the first electronic device from the access-restricted state to an accessible state in which the first electronic device can be accessed by the user by providing, by the first electronic device, the password to an operating system executing on the first electronic device to unlock the first electronic device, wherein the password is provided such that the first electronic device automatically transitions from the access-restricted state to the accessible state without user input to the first electronic device.

18. The method of claim 5 ,

wherein the message from the second electronic device is received while a user interface of the first electronic device is in a locked state; and

wherein providing the password to software executing on the first electronic device to enable access to the first electronic device comprises:

providing the password upon entry of the second electronic device within a predetermined level of proximity of the first electronic device such that the first electronic device automatically transitions the user interface from the locked state to an unlocked state without user input to the first electronic device.

19. The method of claim 5 , comprising:

from a locked state of the first electronic device and without user input to the first electronic device, initiating log-in of a specific user to the first electronic device and unlocking the first electronic device, the log-in of the specific user being initiated in response to communication of the second electronic device with the first electronic device over the wireless communication link.

20. One or more non-transitory machine-readable storage media storing software comprising instructions that are operable, when executed by one or more processors of a first electronic device, to cause the first electronic device to perform operations comprising:

receiving, by the first electronic device and over a wireless communication link, a message from a second electronic device in proximity to the first electronic device, the message being received by the first electronic device while the first electronic device is in an access-restricted state in which access by a user is restricted, wherein the wireless communication link is a direct wireless communication link, and wherein the direct wireless communication link is a Bluetooth communication link; and

while the first electronic device is in the access-restricted state and before user input is provided to the first electronic device by the user following entry of the second electronic device into the proximity to the first electronic device:

determining, by the first electronic device, that the second electronic device has been previously associated with the first electronic device as an authentication factor for accessing the first electronic device, comprising determining that the second electronic device has previously been paired with the first electronic device using Bluetooth communication;

receiving, by the first electronic device, an encrypted form of a password from the second electronic device over the wireless communication link;

determining, by the first electronic device, the password from the encrypted form of the password; and

initiating a transition of the first electronic device from the access-restricted state to an accessible state in which the first electronic device can be accessed by the user by providing, by the first electronic device, the password to software executing on the first electronic device to enable access to the first electronic device, wherein the password is provided such that the first electronic device automatically transitions from the access-restricted state to the accessible state without user input to the first electronic device.