Can my name be revealed from a stolen Verifiable Credential?

Question

Let vc be a W3C Verifiable Credential Standard compliant verifiable credential. If I print it out on paper and loose it on the subway, can an attacker pick up the paper, type in the information into a JSON file, upload it to his wallet and

1. impersonate me?
2. learn the VC claims, i.e. name, date of birth (and whatever other claims are in the VC)?

If the attacker wanted to do that, what would he need to do? As I understand it, the subject is represented as a decentralized identifier document (did) which somehow needs to be resolved to my real-world name.

Answer 1

1. impersonate me?

Depending on the proof, the attacker can't impersonate you without your private key used in the signature. That's the "verifiable" part of the credentials.

learn the VC claims, i.e. name, date of birth (and whatever other claims are in the VC)?

The W3C VC data model does not specify that the credential must be encrypted. So if the attacker has your VC, and your VC isn't encrypted, then he'll be able to see whatever claims are part of the credentials.