The format is intentionally being built in a way that you can look at the source, in the same way you would look at minified Javascript currently.
If you're worried about obscurity, look at what is generated by asm.js. WebAssembly won't be any worse than that (and is, in fact, more or less a more efficient/correct equivalent to asm.js).
The problem with hashes of hashes is now instead of the password being directly grabbed, the hash is directly grabbed, which can be thrown through the challenge-response system with no problem.
This only mitigates knowing the password itself, not anything to do with authentication.
On the other hand, there's nothing that's made _worse_ by choosing to do it that way. Plenty of things that are the same, some things better, but nothing worse.
Nobody else has been able to reproduce it, and you haven't given enough information on what you're doing or what you've tried. Have you tried different machines? Different browsers? Have you tried pressing the various buttons in the UI? What kind of machine do you have? Do you have a very small amount of RAM? Et cetera.
You might say your browser works fine, but I'd put my money on something there being the issue.