Yeah I think you are correct that the protocol isn't safe from traffic analysis.