A screen the laptop cannot paint.

The dangerous moment in a hardware wallet is not the cable. It is the second where a person confirms something they did not actually read. Computers are excellent at showing a friendly summary that does not match the request underneath. Novubase puts the summary on a display the computer is not allowed to draw.

The round screen is driven by the security chip. When a request arrives, the chip — not the browser, not the reader window — decides which characters appear inside the copper ring. The reader may show its own summary beside it. That second summary is a convenience. The buttons do not confirm it. They confirm the glass.

The shape is round for a practical reason. A circle in the middle of a palm-sized body is hard to confuse with a laptop window, and the two buttons sit in the only remaining flat area, under the ring, where a thumb already rests. There is no second display and no status LED that could be mistaken for approval.

A home view is allowed. The chip can show a holding it already keeps, so the device has a face when nothing is waiting to be signed. One photograph on the device page shows that home view. It is a picture of the object, the way a camera shows a watch face. It is not a page you act on. Action still requires a request, the glass, and a button.

If the glass and the computer disagree, decline. The left button exists so that “no” is as easy as “yes.” Unplugging the cable is the same answer. The chip does not keep a half-signed request waiting for a later, less careful moment.

The habit is slower than a click. The slowness is the product. A substituted destination is visible only if there is a surface the substitute cannot reach.