Otherwise, you can specify allowed domains individually:
<access origin="https://build.phonegap.com" />
You can also allow subdomains, using the subdomains attribute:
<access origin="http://phonegap.com" subdomains="true" />
To ensure that links to this domain cannot take over the entire webview, use the browserOnly attribute (this defaults to false):
<access origin="http://phonegap.com" browserOnly="true" />
The behaviour of the access element is heavily dependent on the platform you're deploying to - we have a blog post with more information. It is also likely to vary between different releases of PhoneGap - we'll work to maintain sane defaults and configurability for PhoneGap Build users.