The answers are
- No (username is visible) /yes (mostly password is hidden)
- and 3 Not normally, unless you pay extra and implement the Advanced Security Options.
To fill out (1).
The Oracle database has a hash of the password, not the actual password. When you connect, Oracle picks a value and sends it to the client. The client hashes the user-entered password to get the same hash as the database is storing, then uses that to hash the value sent by the database. It sends that back to the database.
In the mean time, the database has also hashed that value with the same hashed password.
If the client has got to the same value as the database, then it is assumed to have come from the same starting point (ie the user's password).
The 11g algorithm is a bit different but the fundamental idea is that the password isn't passed in clear text or trivial hash. It would take a serious attacker.
If the script is sitting on the database server, you can use OS authentication instead of a password. There's other tricks you can do (such as having the database determine which IP address is coming from and whitelist/blackist accordingly).