Stream Vessel lets users authorize their own agent callback addresses

Stream Vessel says it has shipped controls that let users connect their own agents to its storage service without asking the operator to expand a shared list of trusted callback addresses. Each account can trust up to 10 exact HTTPS addresses for receiving authorization responses. The service checks trust after sign-in and refuses to redirect codes or errors to untrusted addresses. Adding an address requires the user's browser session and typed confirmation of the host; removing one revokes associated grants and unexchanged codes. The company dropped a restriction on delete access, and acknowledges that users persuaded to trust an attacker's address can still be phished.