Finger (protocol)
| Company type | Network protocol |
|---|---|
| Industry | Computer networking |
| Founded | 1971 |
| Founder | Les Earnest |
| Products | User information exchange, presence information |
In the realm of computer networking, both the Name/Finger protocol and the Finger user information protocol serve as straightforward network protocols designed to exchange user-centric status details and personal information.
Name/Finger protocol
Originating from Request for Comments document RFC 742 (December 1977), the Name/Finger protocol functions as an interface for the name and finger utilities, which deliver status updates about a system or individual users across networked environments. The finger program was developed in 1971 by Les Earnest to fulfill the need for users to access information about others on the network, such as identifying who was currently logged in—an early implementation of presence information for remote users.
Prior to finger's introduction, systems like WAITS employed a WHO command that displayed user identifiers alongside terminal line numbers for active sessions. Les Earnest explained that the term "FINGER" was inspired by users literally running their fingers down the list produced by the WHO command on WAITS.
Finger user information protocol
The finger service runs as a daemon on TCP port 79. Remote clients establish connections to this port, where a Remote User Information Program (RUIP) handles incoming requests. According to the Finger protocol, clients issue a single-line query, await the server’s reply, and then terminate the connection once the RUIP completes processing.
This protocol is formally specified in RFC 1288 (December 1991). Servers generally operate using fingerd or in.fingerd, while client-side tools such as name or finger generate readable reports concerning systems or individual users. The protocol primarily defines command structure but does not mandate a uniform response format.
Information returned by finger includes user login status, e-mail address, full name, and contents from .project and .plan files located in users’ home directories. These files frequently contain updates on current activities, resembling informal notes or early forms of micro-blogging.
Security concerns
Although initially valued for its convenience in sharing details like e-mail addresses and full names, finger’s disclosure of such information later prompted significant privacy and security apprehensions.
Attackers have leveraged finger data to conduct social engineering schemes by gathering employee names, emails, and phone numbers via finger clients, enabling impersonation to access confidential corporate data.
The finger daemon itself contained exploitable weaknesses; notably, the 1988 Morris worm exploited a buffer overflow vulnerability in fingerd to spread. Due to these security challenges, most Internet hosts ceased offering this service by the late 1990s.
Application support
Finger functionality is available on Unix-like platforms (including macOS, Linux, FreeBSD) as well as modern Windows versions through the finger.exe utility. Additional software supporting finger includes:
- ELinks
- Lynx
- Minuet
- Kristall
- Lagrange