The Finger Protocol is the structured TCP layer used by the name and finger applications on old Unix systems. The finger program was developed by Les_Earnest in 1971 as a way for remote users to see who was signed into a shared server. It could also be used to see a full list of that server's users & their email addresses. This concept laid the framework for the modern social internet as we know it. The plaintext request/response protocol used by the finger application to query a Finger-equipped server was standardized on TCP Port 79 as RFC 742 in 1977.

Openly sharing email addresses and live session data was considered fine in the early years of the internet. But by the early 90's, hackers & corporate spies were abusing the utility to exfiltrate sensitive internal data from corporate, government & military networks. When the daemon itself was found to be hackable - enabling full remote hijacking - it was the final straw and Finger daemons were gradually abandoned. By the turn of the millennium it had mostly vanished, surviving mostly on older systems until gradually most of them were tracked down and exploited as well.

Despite this, the beleaguered protocol still has a small yet avid fanbase that overlaps with the remnants of the once-legendary Gopherspace. This owes to the fact that, when you strip away the software, Finger as a protocol is just a simple plaintext request/response handshake. Normally you ask the server about USER, and the server responds with a plaintext response containing what it knows about USER. However, the protocol specifications do not dictate where this data has to come from or how it is phrased. So hobbyists in the 21st century have developed custom finger daemons that just treat USER like a generic search key, and run it against a dynamic application. Blogs, support portals, social networks, and even weather beacons, are just some examples of what is now being deployed over Port 79.

There are several ways to still utilize the Finger protocol in the 21st century:

Pictured: Finger over the command line.

Since finger is an ancient UNIX utility, it found its way into the Linux ecosystem. While it is no longer preinstalled on machines, it is still available in many repos, and it still works.

Do not use this one, it is a liability. If it is not given an address, it will simply root through your machine instead, and print off a list of sensitive session details. Finger is one of those things some hackers look for right away, because this info is useful to anyone mapping out a machine & its users.

As Finger is a very simple protocol, you can instead use tools like netcat or nc to send raw TCP requests that fit the tight & limited specification of the protocol. I have a network-only finger.sh shell script at humphreyboagart/finger which provides the same functionality without the data leaks. If you know more about TCP than I do, you could probably make a cleaner version, but it's an example of how easy it is to build new software around this ancient forgotten protocol.

The popular CLI web browsers Lynx & ELinks also come with decent support for Finger.

Pictured: Lagrange

The slickest and easiest solution is to install the sleek Gopher & Gemini browser Lagrange, as it provides a quick and visually-pleasing interface to “browse” Finger responses as if they were web sites.

It's fast, the interface is clean, and it's available for iOS, Flatpak, and a multitude of other platforms.

Kristall is another popular Finger “browser” with Gopher & Gemini support.

Despite Finger's initial conception as a way to dig up user & session information from remote computers, the actual transmission of data is a strictly-defined plaintext request/response protocol. This means your server can respond to Finger requests with whatever it wants. As long as the server responds in only plaintext, any compliant Finger client will be able to display it.

The emerging scene of “modern” Finger daemons take the Gopher/Gemini approach, where the daemon simply checks the “username” of the request against a folder of matching plaintext files and/or dynamic CGI scripts. This means you could key a specific Finger request to a CGI script that processes the request and responds with data from an SQL database, or even from applications written in other languages.

For example, modern PHP installs come with php-cli, a command-line version of PHP which spits out plaintext data in a form especially suited for Finger. You just make a CGI wrapper for your PHP script, and pass Finger requests to php-cli like this:

loader.cgi

#!/bin/sh
exec /usr/bin/php /path/to/script.php

For an easy example of serving dynamic data over the Finger protocol, give noveltylanterns/fingered a spin.

The biggest drawback of Finger is that it is unencrypted, and nobody has agreed on a way to encrypt it because few people see a use in doing so.

But if you are like me, and you see a plaintext request/response protocol with no hardcoded markup logic, a dedicated port, and no wasted bandwidth on metadata or headers, then you will see the potential for things like speedy API endpoints & JSON beacons. If you are building mobile apps or using Meshtastic, then I don't even have to explain the benefit of maximizing bandwidth efficiency. So one day I got bored and had ChatGPT & Claude help draft a protocol spec for wrapping Finger with TLS 1.3, just to see what it would entail.

Well it turns out anyone can define a protocol, and it doesn't even need to be widely adopted if you're just using it internally with your own projects. As long as the spec is coherent, you can build unlimited compatible applications around your own custom API endpoints with dedicated ports, and start saving on bandwidth & CPU cycles.

You can see the example in-progress fingers draft spec at noveltylanterns/fingers. Once we get relays figured out, I think we'll be able to do some great things with this ancient technology.

• Novelty Lanterns Ltd. Co.
• Finger Ring at TheBackupBox
• Happy Net Box
• plan.cat
• tilde.team
• Weather at Graph.no

• RFC 742 - The original Finger specification (1977)
• RFC 1288 - Last official revision of the Finger specification (1991)
• Finger (protocol)