Where does finger connect to by default?

According to strace finger, on my system it gets the list of current users from

open("/var/run/utmp", O_RDONLY|O_CLOEXEC) = 4

and details about each one by stating the pty

stat("/dev//pts/0", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0

when run without arguments. When you run it with @localhost, it tries to use the fingerd daemon, and since it's not 1993 any more, that's not running - hence the connection refused.

Edit when run with an argument which is a user, rather than @remote-system, it gets the information from the GECOS field in /etc/passwd and the home directory (for files like ~/.plan). It doesn't have privilege, so users will need home directories and plan files you can read in order to display e.g. the plan file. Here (also from strace) you see it both trying, and failing, to open some of these files in another user's directory, which is mode 750 (and I'm not in her group):

lstat("/home/cby/.pgpkey", 0x7fff52fcec60) = -1 EACCES (Permission denied)
lstat("/home/cby/.project", 0x7fff52fcec60) = -1 EACCES (Permission denied)
lstat("/home/cby/.plan", 0x7fff52fcec60) = -1 EACCES (Permission denied)